# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 19.11.2019 08:17:44.267 Process: id = "1" image_name = "wzmjbq.exe" filename = "c:\\users\\fd1hvy\\desktop\\wzmjbq.exe" page_root = "0x54b1000" os_pid = "0xecc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\wzmjbq.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xf00 [0036.544] GetUserDefaultLangID () returned 0x409 [0036.549] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0036.549] GetProcessHeap () returned 0x1130000 [0036.549] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1148720 [0036.549] GetKeyboardLayoutList (in: nBuff=1, lpList=0x1148720 | out: lpList=0x1148720) returned 1 [0036.549] GetProcessHeap () returned 0x1130000 [0036.549] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1148720 | out: hHeap=0x1130000) returned 1 [0036.549] CoCreateInstance (in: rclsid=0x129c210*(Data1=0x674b6698, Data2=0xee92, Data3=0x11d0, Data4=([0]=0xad, [1]=0x71, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd8, [6]=0xfd, [7]=0xff)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x129c170*(Data1=0x44aca674, Data2=0xe8fc, Data3=0x11d0, Data4=([0]=0xa0, [1]=0x7c, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0xeefe24 | out: ppv=0xeefe24*=0x0) returned 0x800401f0 [0036.550] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Wacatac", ulOptions=0x0, samDesired=0xf003f, phkResult=0x129f1a8 | out: phkResult=0x129f1a8*=0x0) returned 0x2 [0036.550] RegCreateKeyA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Wacatac", phkResult=0x129f1a8 | out: phkResult=0x129f1a8*=0x1fc) returned 0x0 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1148720 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1148730 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1148740 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x11485b0 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x11485c0 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x11485e0 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x11485f0 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b98 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b18 [0036.551] GetProcessHeap () returned 0x1130000 [0036.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0036.551] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0036.552] GetProcAddress (hModule=0x761b0000, lpProcName="SystemFunction036") returned 0x746729e0 [0036.552] SystemFunction036 (in: RandomBuffer=0xeefd68, RandomBufferLength=0x80 | out: RandomBuffer=0xeefd68) returned 1 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x11485c0, Size=0x80) returned 0x1143320 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ad8 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c48 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x102) returned 0x113fce8 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1068) returned 0x1150cb0 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.552] GetProcessHeap () returned 0x1130000 [0036.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.553] GetProcessHeap () returned 0x1130000 [0036.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x113efb8 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0036.554] GetProcessHeap () returned 0x1130000 [0036.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0036.554] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0036.555] GetProcessHeap () returned 0x1130000 [0036.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0036.556] GetProcessHeap () returned 0x1130000 [0036.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0036.556] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0036.557] GetProcessHeap () returned 0x1130000 [0036.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.557] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0036.558] GetProcessHeap () returned 0x1130000 [0036.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.558] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.559] GetProcessHeap () returned 0x1130000 [0036.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0036.570] GetProcessHeap () returned 0x1130000 [0036.572] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0036.573] GetProcessHeap () returned 0x1130000 [0036.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0036.573] GetProcessHeap () returned 0x1130000 [0036.573] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0036.574] GetProcessHeap () returned 0x1130000 [0036.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0036.574] GetProcessHeap () returned 0x1130000 [0036.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0036.574] GetProcessHeap () returned 0x1130000 [0036.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.574] GetProcessHeap () returned 0x1130000 [0036.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.574] GetProcessHeap () returned 0x1130000 [0036.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0036.574] GetProcessHeap () returned 0x1130000 [0036.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0036.575] GetProcessHeap () returned 0x1130000 [0036.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0036.575] GetProcessHeap () returned 0x1130000 [0036.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0036.575] GetProcessHeap () returned 0x1130000 [0036.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0036.575] GetProcessHeap () returned 0x1130000 [0036.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0036.575] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.576] GetProcessHeap () returned 0x1130000 [0036.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.576] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.577] GetProcessHeap () returned 0x1130000 [0036.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.577] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.578] GetProcessHeap () returned 0x1130000 [0036.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.579] GetProcessHeap () returned 0x1130000 [0036.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0036.579] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.580] GetProcessHeap () returned 0x1130000 [0036.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.581] GetProcessHeap () returned 0x1130000 [0036.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.582] GetProcessHeap () returned 0x1130000 [0036.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0036.583] GetProcessHeap () returned 0x1130000 [0036.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0036.584] GetProcessHeap () returned 0x1130000 [0036.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0036.585] GetProcessHeap () returned 0x1130000 [0036.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0036.585] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0036.586] GetProcessHeap () returned 0x1130000 [0036.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0036.587] GetProcessHeap () returned 0x1130000 [0036.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0036.587] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152078 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0036.588] GetProcessHeap () returned 0x1130000 [0036.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0036.588] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0036.589] GetProcessHeap () returned 0x1130000 [0036.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0036.589] GetProcessHeap () returned 0x1130000 [0036.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152ba0 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152ba0 | out: hHeap=0x1130000) returned 1 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0036.590] GetProcessHeap () returned 0x1130000 [0036.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0036.591] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c48, Size=0x84) returned 0x113efb8 [0036.591] GetProcessHeap () returned 0x1130000 [0036.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0036.591] GetProcessHeap () returned 0x1130000 [0036.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0036.591] GetProcessHeap () returned 0x1130000 [0036.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0036.591] GetProcessHeap () returned 0x1130000 [0036.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0036.591] GetProcessHeap () returned 0x1130000 [0036.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0036.591] GetProcessHeap () returned 0x1130000 [0036.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0036.591] GetProcessHeap () returned 0x1130000 [0036.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b38 [0036.591] GetProcessHeap () returned 0x1130000 [0036.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0036.591] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b08 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b38 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b08 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b28 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b28 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b38 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b38 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x10) returned 0x114fbb0 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x113af90 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114fbb0 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x38) returned 0x114b010 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113af90 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x38) returned 0x114b2d0 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114b010 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x68) returned 0x113e6a0 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114b2d0 | out: hHeap=0x1130000) returned 1 [0036.592] GetProcessHeap () returned 0x1130000 [0036.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0xd0) returned 0x114a848 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113e6a0 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0xd0) returned 0x114a920 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114a848 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114a920 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.593] GetProcessHeap () returned 0x1130000 [0036.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.593] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.594] GetProcessHeap () returned 0x1130000 [0036.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.594] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.595] GetProcessHeap () returned 0x1130000 [0036.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.596] GetProcessHeap () returned 0x1130000 [0036.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.597] GetProcessHeap () returned 0x1130000 [0036.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.598] GetProcessHeap () returned 0x1130000 [0036.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.599] GetProcessHeap () returned 0x1130000 [0036.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.599] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.600] GetProcessHeap () returned 0x1130000 [0036.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.601] GetProcessHeap () returned 0x1130000 [0036.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.602] GetProcessHeap () returned 0x1130000 [0036.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.602] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.603] GetProcessHeap () returned 0x1130000 [0036.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.604] GetProcessHeap () returned 0x1130000 [0036.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.604] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.605] GetProcessHeap () returned 0x1130000 [0036.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.605] GetProcessHeap () returned 0x1130000 [0036.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.606] GetProcessHeap () returned 0x1130000 [0036.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.606] GetProcessHeap () returned 0x1130000 [0036.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.634] GetProcessHeap () returned 0x1130000 [0036.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.634] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.635] GetProcessHeap () returned 0x1130000 [0036.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.635] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.636] GetProcessHeap () returned 0x1130000 [0036.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.637] GetProcessHeap () returned 0x1130000 [0036.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.638] GetProcessHeap () returned 0x1130000 [0036.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11413d8 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.639] GetProcessHeap () returned 0x1130000 [0036.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.639] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.640] GetProcessHeap () returned 0x1130000 [0036.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.640] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.641] GetProcessHeap () returned 0x1130000 [0036.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1141c70 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.642] GetProcessHeap () returned 0x1130000 [0036.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.643] GetProcessHeap () returned 0x1130000 [0036.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1141c70 [0036.643] GetProcessHeap () returned 0x1130000 [0036.643] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11413d8 | out: hHeap=0x1130000) returned 1 [0036.643] GetProcessHeap () returned 0x1130000 [0036.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11413d8 [0036.643] GetProcessHeap () returned 0x1130000 [0036.643] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141c70 | out: hHeap=0x1130000) returned 1 [0036.731] GetProcessHeap () returned 0x1130000 [0036.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0036.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] GetProcessHeap () returned 0x1130000 [0036.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0036.769] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11541b8 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] GetProcessHeap () returned 0x1130000 [0036.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] GetProcessHeap () returned 0x1130000 [0036.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0036.771] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0036.772] GetProcessHeap () returned 0x1130000 [0036.772] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] GetProcessHeap () returned 0x1130000 [0036.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0036.773] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] GetProcessHeap () returned 0x1130000 [0036.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.774] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154730 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.775] GetProcessHeap () returned 0x1130000 [0036.775] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154730 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] GetProcessHeap () returned 0x1130000 [0036.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] GetProcessHeap () returned 0x1130000 [0036.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] GetProcessHeap () returned 0x1130000 [0036.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.778] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154960 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] GetProcessHeap () returned 0x1130000 [0036.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.779] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] GetProcessHeap () returned 0x1130000 [0036.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.780] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154730 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.781] GetProcessHeap () returned 0x1130000 [0036.781] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11541b8 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154730 | out: hHeap=0x1130000) returned 1 [0036.782] GetProcessHeap () returned 0x1130000 [0036.782] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] GetProcessHeap () returned 0x1130000 [0036.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.783] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] GetProcessHeap () returned 0x1130000 [0036.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] GetProcessHeap () returned 0x1130000 [0036.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0036.785] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154a78 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11541b8 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0036.786] GetProcessHeap () returned 0x1130000 [0036.786] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154960 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] GetProcessHeap () returned 0x1130000 [0036.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] GetProcessHeap () returned 0x1130000 [0036.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0036.788] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] GetProcessHeap () returned 0x1130000 [0036.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0036.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.825] GetProcessHeap () returned 0x1130000 [0036.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154730 | out: hHeap=0x1130000) returned 1 [0036.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0036.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0036.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0036.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.044] GetProcessHeap () returned 0x1130000 [0037.059] GetProcessHeap () returned 0x1130000 [0037.115] GetProcessHeap () returned 0x1130000 [0037.115] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.115] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.116] GetProcessHeap () returned 0x1130000 [0037.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.116] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.117] GetProcessHeap () returned 0x1130000 [0037.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.117] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.118] GetProcessHeap () returned 0x1130000 [0037.118] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.118] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.119] GetProcessHeap () returned 0x1130000 [0037.119] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.120] GetProcessHeap () returned 0x1130000 [0037.120] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.120] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.121] GetProcessHeap () returned 0x1130000 [0037.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.121] GetProcessHeap () returned 0x1130000 [0037.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.122] GetProcessHeap () returned 0x1130000 [0037.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.122] GetProcessHeap () returned 0x1130000 [0037.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.122] GetProcessHeap () returned 0x1130000 [0037.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.122] GetProcessHeap () returned 0x1130000 [0037.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.122] GetProcessHeap () returned 0x1130000 [0037.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.122] GetProcessHeap () returned 0x1130000 [0037.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0037.122] GetProcessHeap () returned 0x1130000 [0037.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.123] GetProcessHeap () returned 0x1130000 [0037.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.123] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.124] GetProcessHeap () returned 0x1130000 [0037.124] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.124] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.125] GetProcessHeap () returned 0x1130000 [0037.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.126] GetProcessHeap () returned 0x1130000 [0037.126] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.126] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.127] GetProcessHeap () returned 0x1130000 [0037.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.128] GetProcessHeap () returned 0x1130000 [0037.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.128] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.129] GetProcessHeap () returned 0x1130000 [0037.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.129] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.130] GetProcessHeap () returned 0x1130000 [0037.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.130] GetProcessHeap () returned 0x1130000 [0037.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.131] GetProcessHeap () returned 0x1130000 [0037.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.131] GetProcessHeap () returned 0x1130000 [0037.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11542d0 [0037.131] GetProcessHeap () returned 0x1130000 [0037.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.131] GetProcessHeap () returned 0x1130000 [0037.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.131] GetProcessHeap () returned 0x1130000 [0037.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.131] GetProcessHeap () returned 0x1130000 [0037.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.138] GetProcessHeap () returned 0x1130000 [0037.169] GetProcessHeap () returned 0x1130000 [0037.185] GetProcessHeap () returned 0x1130000 [0037.201] GetProcessHeap () returned 0x1130000 [0037.214] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1148720, Size=0x80) returned 0x1152078 [0037.214] GetProcessHeap () returned 0x1130000 [0037.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113fce8 | out: hHeap=0x1130000) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c48 | out: hHeap=0x1130000) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113efb8 | out: hHeap=0x1130000) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x80) returned 0x1152ba0 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11485e0 | out: hHeap=0x1130000) returned 1 [0037.215] SystemFunction036 (in: RandomBuffer=0xeefd68, RandomBufferLength=0x80 | out: RandomBuffer=0xeefd68) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x102) returned 0x11542d0 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1068) returned 0x1150cb0 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0037.215] GetProcessHeap () returned 0x1130000 [0037.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.215] GetProcessHeap () returned 0x1130000 [0037.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0037.216] GetProcessHeap () returned 0x1130000 [0037.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.217] GetProcessHeap () returned 0x1130000 [0037.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0037.218] GetProcessHeap () returned 0x1130000 [0037.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.219] GetProcessHeap () returned 0x1130000 [0037.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0037.220] GetProcessHeap () returned 0x1130000 [0037.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.221] GetProcessHeap () returned 0x1130000 [0037.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.222] GetProcessHeap () returned 0x1130000 [0037.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0037.223] GetProcessHeap () returned 0x1130000 [0037.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.224] GetProcessHeap () returned 0x1130000 [0037.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.225] GetProcessHeap () returned 0x1130000 [0037.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.226] GetProcessHeap () returned 0x1130000 [0037.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.226] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0037.227] GetProcessHeap () returned 0x1130000 [0037.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0037.227] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0037.228] GetProcessHeap () returned 0x1130000 [0037.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0037.228] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0037.229] GetProcessHeap () returned 0x1130000 [0037.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0037.229] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0037.230] GetProcessHeap () returned 0x1130000 [0037.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0037.230] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a08 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a08 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.231] GetProcessHeap () returned 0x1130000 [0037.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.232] GetProcessHeap () returned 0x1130000 [0037.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.232] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152188 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152188 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.233] GetProcessHeap () returned 0x1130000 [0037.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.233] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11524b8 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11524b8 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.234] GetProcessHeap () returned 0x1130000 [0037.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0037.234] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152320 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152320 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152100 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152100 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.235] GetProcessHeap () returned 0x1130000 [0037.235] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.235] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11523a8 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11523a8 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152870 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152870 | out: hHeap=0x1130000) returned 1 [0037.236] GetProcessHeap () returned 0x1130000 [0037.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151d48 [0037.236] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151d48 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152540 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152540 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152430 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152430 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152a90 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152a90 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151dd0 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151dd0 | out: hHeap=0x1130000) returned 1 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152980 [0037.237] GetProcessHeap () returned 0x1130000 [0037.237] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152980 | out: hHeap=0x1130000) returned 1 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152c28 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11526d8 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0037.238] GetProcessHeap () returned 0x1130000 [0037.238] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0037.238] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x84) returned 0x1155150 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c18 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ad8 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ad8 | out: hHeap=0x1130000) returned 1 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c28 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c28 | out: hHeap=0x1130000) returned 1 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0037.239] GetProcessHeap () returned 0x1130000 [0037.239] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0037.239] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b28 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c38 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b28 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0xc) returned 0x114fa48 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c38 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x10) returned 0x114fa78 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114fa48 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x113af90 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114fa78 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x38) returned 0x114b010 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113af90 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x70) returned 0x113e8d8 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114b010 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0xd8) returned 0x1141f38 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x113e8d8 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0xdc) returned 0x1140e58 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1141f38 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1140e58 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.240] GetProcessHeap () returned 0x1130000 [0037.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.241] GetProcessHeap () returned 0x1130000 [0037.241] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.241] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154730 | out: hHeap=0x1130000) returned 1 [0037.242] GetProcessHeap () returned 0x1130000 [0037.242] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.242] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0037.243] GetProcessHeap () returned 0x1130000 [0037.243] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11541b8 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.244] GetProcessHeap () returned 0x1130000 [0037.244] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0037.245] GetProcessHeap () returned 0x1130000 [0037.245] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.246] GetProcessHeap () returned 0x1130000 [0037.246] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.247] GetProcessHeap () returned 0x1130000 [0037.247] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.247] GetProcessHeap () returned 0x1130000 [0037.247] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.247] GetProcessHeap () returned 0x1130000 [0037.247] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.247] GetProcessHeap () returned 0x1130000 [0037.247] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.247] GetProcessHeap () returned 0x1130000 [0037.247] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.247] GetProcessHeap () returned 0x1130000 [0037.247] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.247] GetProcessHeap () returned 0x1130000 [0037.250] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.250] GetProcessHeap () returned 0x1130000 [0037.250] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.250] GetProcessHeap () returned 0x1130000 [0037.250] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.250] GetProcessHeap () returned 0x1130000 [0037.250] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0037.250] GetProcessHeap () returned 0x1130000 [0037.250] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.250] GetProcessHeap () returned 0x1130000 [0037.250] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0037.250] GetProcessHeap () returned 0x1130000 [0037.250] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.250] GetProcessHeap () returned 0x1130000 [0037.250] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0037.250] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.251] GetProcessHeap () returned 0x1130000 [0037.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.251] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11541b8 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.252] GetProcessHeap () returned 0x1130000 [0037.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.252] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.253] GetProcessHeap () returned 0x1130000 [0037.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.253] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154a78 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.254] GetProcessHeap () returned 0x1130000 [0037.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154960 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.255] GetProcessHeap () returned 0x1130000 [0037.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154730 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154730 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.256] GetProcessHeap () returned 0x1130000 [0037.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.256] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154960 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152f60 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0037.257] GetProcessHeap () returned 0x1130000 [0037.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152f60 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11541b8 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154960 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.258] GetProcessHeap () returned 0x1130000 [0037.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154848 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.259] GetProcessHeap () returned 0x1130000 [0037.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154848 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153068 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153068 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0037.260] GetProcessHeap () returned 0x1130000 [0037.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11541b8 [0037.261] GetProcessHeap () returned 0x1130000 [0037.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.261] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11541b8 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153f88 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153f88 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.262] GetProcessHeap () returned 0x1130000 [0037.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0037.287] GetProcessHeap () returned 0x1130000 [0037.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154b90 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154b90 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11543e8 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11543e8 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153d58 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153d58 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1153e70 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153e70 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154500 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0037.288] GetProcessHeap () returned 0x1130000 [0037.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154500 | out: hHeap=0x1130000) returned 1 [0037.288] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154618 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154618 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152d50 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154960 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152d50 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154960 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x1154a78 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153698 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154a78 | out: hHeap=0x1130000) returned 1 [0037.289] GetProcessHeap () returned 0x1130000 [0037.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1152e58 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153698 | out: hHeap=0x1130000) returned 1 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11538a8 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152e58 | out: hHeap=0x1130000) returned 1 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x104) returned 0x11540a0 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11538a8 | out: hHeap=0x1130000) returned 1 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11540a0 | out: hHeap=0x1130000) returned 1 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0037.290] GetProcessHeap () returned 0x1130000 [0037.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1148730, Size=0x80) returned 0x11526d8 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11542d0 | out: hHeap=0x1130000) returned 1 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1154a78 | out: hHeap=0x1130000) returned 1 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1155150 | out: hHeap=0x1130000) returned 1 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x80) returned 0x1152c28 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b08, Size=0x100) returned 0x1153698 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x100) returned 0x1153170 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x100) returned 0x1153380 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1153380, Size=0x104) returned 0x1154730 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b28, Size=0x8) returned 0x1150c38 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c38, Size=0x104) returned 0x1154618 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x8) returned 0x1150bf8 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b18, Size=0x8) returned 0x1150b08 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0037.335] GetProcessHeap () returned 0x1130000 [0037.335] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0037.335] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x100) returned 0x1152e58 [0037.336] GetProcessHeap () returned 0x1130000 [0037.336] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x100) returned 0x1153380 [0037.336] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x11485f0, Size=0x100) returned 0x1152e58 [0037.336] GetProcessHeap () returned 0x1130000 [0037.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152078 | out: hHeap=0x1130000) returned 1 [0037.336] GetProcessHeap () returned 0x1130000 [0037.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11526d8 | out: hHeap=0x1130000) returned 1 [0037.336] GetProcessHeap () returned 0x1130000 [0037.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0037.336] GetProcessHeap () returned 0x1130000 [0037.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1148740 | out: hHeap=0x1130000) returned 1 [0037.336] GetProcessHeap () returned 0x1130000 [0037.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1143320 | out: hHeap=0x1130000) returned 1 [0037.336] GetProcessHeap () returned 0x1130000 [0037.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152c28 | out: hHeap=0x1130000) returned 1 [0037.336] RegSetValueExA (in: hKey=0x1fc, lpValueName="public", Reserved=0x0, dwType=0x3, lpData=0x129f068*, cbData=0x100 | out: lpData=0x129f068*) returned 0x0 [0037.336] SystemFunction036 (in: RandomBuffer=0xeefd90, RandomBufferLength=0x20 | out: RandomBuffer=0xeefd90) returned 1 [0037.341] GetProcessHeap () returned 0x1130000 [0037.341] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x220) returned 0x1142828 [0037.342] RegSetValueExA (in: hKey=0x1fc, lpValueName="private", Reserved=0x0, dwType=0x3, lpData=0x1142828*, cbData=0x220 | out: lpData=0x1142828*) returned 0x0 [0037.342] GetProcessHeap () returned 0x1130000 [0037.342] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x2d9) returned 0x114d730 [0037.342] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: %s\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 1793 [0037.342] GetProcessHeap () returned 0x1130000 [0037.342] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x9db) returned 0x114ecf0 [0037.343] wnsprintfA (in: pszDest=0x114ecf0, cchDest=2523, pszFmt=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: %s\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam." | out: pszDest=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0037.343] GetProcessHeap () returned 0x1130000 [0037.343] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1142828 | out: hHeap=0x1130000) returned 1 [0037.343] RegCloseKey (hKey=0x1fc) returned 0x0 [0037.347] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x1) returned 0x8000ffff [0038.973] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x0, lphEnum=0xeefe20 | out: lphEnum=0xeefe20*=0x1170c60) returned 0x0 [0039.361] GetProcessHeap () returned 0x1130000 [0039.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4000) returned 0x117bf70 [0039.361] WNetEnumResourceW (in: hEnum=0x1170c60, lpcCount=0xeefe28, lpBuffer=0x117bf70, lpBufferSize=0xeefe24 | out: lpcCount=0xeefe28, lpBuffer=0x117bf70, lpBufferSize=0xeefe24) returned 0x0 [0039.361] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x117bf70, lphEnum=0xeefdf8 | out: lphEnum=0xeefdf8*=0x1170398) returned 0x0 [0039.364] GetProcessHeap () returned 0x1130000 [0039.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4000) returned 0x117ff78 [0039.364] WNetEnumResourceW (in: hEnum=0x1170398, lpcCount=0xeefe00, lpBuffer=0x117ff78, lpBufferSize=0xeefdfc | out: lpcCount=0xeefe00, lpBuffer=0x117ff78, lpBufferSize=0xeefdfc) returned 0x103 [0039.364] GetProcessHeap () returned 0x1130000 [0039.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x117ff78 | out: hHeap=0x1130000) returned 1 [0039.364] WNetCloseEnum (hEnum=0x1170398) returned 0x0 [0039.364] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x117bf90, lphEnum=0xeefdf8 | out: lphEnum=0xeefdf8*=0x1170398) returned 0x4b8 [0052.293] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x117bfb0, lphEnum=0xeefdf8 | out: lphEnum=0xeefdf8*=0x1170398) returned 0x4c6 [0052.298] WNetEnumResourceW (in: hEnum=0x1170c60, lpcCount=0xeefe28, lpBuffer=0x117bf70, lpBufferSize=0xeefe24 | out: lpcCount=0xeefe28, lpBuffer=0x117bf70, lpBufferSize=0xeefe24) returned 0x103 [0052.298] GetProcessHeap () returned 0x1130000 [0052.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x117bf70 | out: hHeap=0x1130000) returned 1 [0052.298] WNetCloseEnum (hEnum=0x1170c60) returned 0x0 [0052.298] GetLogicalDriveStringsW (in: nBufferLength=0x7fff, lpBuffer=0xeeff58 | out: lpBuffer="C:\\") returned 0x4 [0052.298] GetProcessHeap () returned 0x1130000 [0052.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x117bf70 [0052.299] wnsprintfW (in: pszDest=0x117bf70, cchDest=32767, pszFmt="\\\\?\\%c:" | out: pszDest="\\\\?\\C:") returned 6 [0052.299] GetProcessHeap () returned 0x1130000 [0052.299] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0052.300] lstrcpyW (in: lpString1=0x118bf78, lpString2="\\\\?\\C:" | out: lpString1="\\\\?\\C:") returned="\\\\?\\C:" [0052.300] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 0 [0052.300] QueueUserWorkItem (Function=0x129a680, Context=0x118bf78, Flags=0x0) returned 1 [0052.300] GetProcessHeap () returned 0x1130000 [0052.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x119bf80 [0052.301] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\*") returned 8 [0052.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf47df, dwReserved1=0x7731ac3b, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x1170fa0 [0052.301] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent") returned 18 [0052.301] lstrcmpW (lpString1="$GetCurrent", lpString2="..") returned -1 [0052.301] lstrcmpW (lpString1="$GetCurrent", lpString2=".") returned -1 [0052.303] StrStrW (lpFirst="$getcurrent", lpSrch="programdata") returned 0x0 [0052.303] StrStrW (lpFirst="$getcurrent", lpSrch="$recycle.bin") returned 0x0 [0052.303] StrStrW (lpFirst="$getcurrent", lpSrch="program files") returned 0x0 [0052.303] StrStrW (lpFirst="$getcurrent", lpSrch="windows") returned 0x0 [0052.303] StrStrW (lpFirst="$getcurrent", lpSrch="all users") returned 0x0 [0052.303] StrStrW (lpFirst="$getcurrent", lpSrch="appdata") returned 0x0 [0052.303] GetProcessHeap () returned 0x1130000 [0052.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11abf88 [0052.304] lstrcpyW (in: lpString1=0x11abf88, lpString2="\\\\?\\C:\\$GetCurrent" | out: lpString1="\\\\?\\C:\\$GetCurrent") returned="\\\\?\\C:\\$GetCurrent" [0052.304] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 1 [0052.304] QueueUserWorkItem (Function=0x129a680, Context=0x11abf88, Flags=0x0) returned 1 [0052.304] GetProcessHeap () returned 0x1130000 [0052.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bbf90 [0052.305] wnsprintfW (in: pszDest=0x11bbf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\$GetCurrent\\*") returned 20 [0052.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0052.306] wnsprintfW (in: pszDest=0x11bbf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\.") returned 20 [0052.306] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.306] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.306] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.306] wnsprintfW (in: pszDest=0x11bbf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\..") returned 21 [0052.306] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.306] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0052.306] wnsprintfW (in: pszDest=0x11bbf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs") returned 23 [0052.306] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0052.306] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0052.306] StrStrW (lpFirst="logs", lpSrch="programdata") returned 0x0 [0052.306] StrStrW (lpFirst="logs", lpSrch="$recycle.bin") returned 0x0 [0052.306] StrStrW (lpFirst="logs", lpSrch="program files") returned 0x0 [0052.307] StrStrW (lpFirst="logs", lpSrch="windows") returned 0x0 [0052.307] StrStrW (lpFirst="logs", lpSrch="all users") returned 0x0 [0052.307] StrStrW (lpFirst="logs", lpSrch="appdata") returned 0x0 [0052.307] GetProcessHeap () returned 0x1130000 [0052.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cbf98 [0052.307] lstrcpyW (in: lpString1=0x11cbf98, lpString2="\\\\?\\C:\\$GetCurrent\\Logs" | out: lpString1="\\\\?\\C:\\$GetCurrent\\Logs") returned="\\\\?\\C:\\$GetCurrent\\Logs" [0052.308] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 2 [0052.308] QueueUserWorkItem (Function=0x129a680, Context=0x11cbf98, Flags=0x0) returned 1 [0052.308] GetProcessHeap () returned 0x1130000 [0052.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11dbfa0 [0052.308] wnsprintfW (in: pszDest=0x11dbfa0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\*") returned 25 [0052.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0052.311] wnsprintfW (in: pszDest=0x11dbfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\.") returned 25 [0052.311] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.311] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.311] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.311] wnsprintfW (in: pszDest=0x11dbfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\..") returned 26 [0052.311] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.311] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x2, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0052.311] wnsprintfW (in: pszDest=0x11dbfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 61 [0052.311] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x2, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0052.311] wnsprintfW (in: pszDest=0x11dbfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 56 [0052.311] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x2, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0052.311] wnsprintfW (in: pszDest=0x11dbfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 54 [0052.311] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x2, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0052.311] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0052.312] wnsprintfW (in: pszDest=0x11dbfa0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\read_me.txt") returned 35 [0052.312] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\read_me.txt" (normalized: "c:\\$getcurrent\\logs\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.313] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.313] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.314] CloseHandle (hObject=0x3b0) returned 1 [0052.316] GetProcessHeap () returned 0x1130000 [0052.316] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11dbfa0 | out: hHeap=0x1130000) returned 1 [0052.317] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0052.317] wnsprintfW (in: pszDest=0x11bbf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS") returned 25 [0052.317] lstrcmpW (lpString1="SafeOS", lpString2="..") returned 1 [0052.317] lstrcmpW (lpString1="SafeOS", lpString2=".") returned 1 [0052.317] StrStrW (lpFirst="safeos", lpSrch="programdata") returned 0x0 [0052.317] StrStrW (lpFirst="safeos", lpSrch="$recycle.bin") returned 0x0 [0052.317] StrStrW (lpFirst="safeos", lpSrch="program files") returned 0x0 [0052.317] StrStrW (lpFirst="safeos", lpSrch="windows") returned 0x0 [0052.317] StrStrW (lpFirst="safeos", lpSrch="all users") returned 0x0 [0052.317] StrStrW (lpFirst="safeos", lpSrch="appdata") returned 0x0 [0052.317] GetProcessHeap () returned 0x1130000 [0052.317] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11dbfa0 [0052.318] lstrcpyW (in: lpString1=0x11dbfa0, lpString2="\\\\?\\C:\\$GetCurrent\\SafeOS" | out: lpString1="\\\\?\\C:\\$GetCurrent\\SafeOS") returned="\\\\?\\C:\\$GetCurrent\\SafeOS" [0052.318] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 3 [0052.318] QueueUserWorkItem (Function=0x129a680, Context=0x11dbfa0, Flags=0x0) returned 1 [0052.318] GetProcessHeap () returned 0x1130000 [0052.318] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ebfa8 [0052.318] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\*") returned 27 [0052.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x11709a0 [0052.442] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\.") returned 27 [0052.446] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.450] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.450] FindNextFileW (in: hFindFile=0x11709a0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xf1003fdc, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1003fdc, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.484] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\..") returned 28 [0052.484] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.484] FindNextFileW (in: hFindFile=0x11709a0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x2, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.wctc", cAlternateFileName="GETCUR~1.WCT")) returned 1 [0052.484] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.wctc") returned 49 [0052.484] FindNextFileW (in: hFindFile=0x11709a0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x2, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.wctc", cAlternateFileName="GETCUR~2.WCT")) returned 1 [0052.484] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.wctc") returned 53 [0052.484] FindNextFileW (in: hFindFile=0x11709a0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x2, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.wctc", cAlternateFileName="PARTNE~1.WCT")) returned 1 [0052.484] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.wctc") returned 55 [0052.484] FindNextFileW (in: hFindFile=0x11709a0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x2, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0052.484] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 37 [0052.484] FindNextFileW (in: hFindFile=0x11709a0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0052.484] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 43 [0052.484] FindNextFileW (in: hFindFile=0x11709a0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0052.484] FindClose (in: hFindFile=0x11709a0 | out: hFindFile=0x11709a0) returned 0 [0052.484] wnsprintfW (in: pszDest=0x11ebfa8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\read_me.txt") returned 37 [0052.484] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\read_me.txt" (normalized: "c:\\$getcurrent\\safeos\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0052.485] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.485] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.486] CloseHandle (hObject=0x3b4) returned 1 [0052.486] GetProcessHeap () returned 0x1130000 [0052.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ebfa8 | out: hHeap=0x1130000) returned 1 [0052.488] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0x0, cFileName="safeos", cAlternateFileName="")) returned 0 [0052.488] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0052.488] wnsprintfW (in: pszDest=0x11bbf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\$GetCurrent\\read_me.txt") returned 30 [0052.488] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\read_me.txt" (normalized: "c:\\$getcurrent\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0052.488] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.488] WriteFile (in: hFile=0x3ac, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefbbc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefbbc*=0x9d7, lpOverlapped=0x0) returned 1 [0052.489] CloseHandle (hObject=0x3ac) returned 1 [0052.489] GetProcessHeap () returned 0x1130000 [0052.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bbf90 | out: hHeap=0x1130000) returned 1 [0052.491] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf47df, dwReserved1=0x7731ac3b, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0052.491] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$Recycle.Bin") returned 19 [0052.491] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0052.491] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0052.491] StrStrW (lpFirst="$recycle.bin", lpSrch="programdata") returned 0x0 [0052.491] StrStrW (lpFirst="$recycle.bin", lpSrch="$recycle.bin") returned="$recycle.bin" [0052.491] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf47df, dwReserved1=0x7731ac3b, cFileName="$WINRE_BACKUP_PARTITION.MARKER.wctc", cAlternateFileName="$WINRE~1.WCT")) returned 1 [0052.491] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER.wctc") returned 42 [0052.491] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf47df, dwReserved1=0x7731ac3b, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0052.491] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212") returned 25 [0052.491] lstrcmpW (lpString1="588bce7c90097ed212", lpString2="..") returned 1 [0052.491] lstrcmpW (lpString1="588bce7c90097ed212", lpString2=".") returned 1 [0052.491] StrStrW (lpFirst="588bce7c90097ed212", lpSrch="programdata") returned 0x0 [0052.491] StrStrW (lpFirst="588bce7c90097ed212", lpSrch="$recycle.bin") returned 0x0 [0052.492] StrStrW (lpFirst="588bce7c90097ed212", lpSrch="program files") returned 0x0 [0052.492] StrStrW (lpFirst="588bce7c90097ed212", lpSrch="windows") returned 0x0 [0052.492] StrStrW (lpFirst="588bce7c90097ed212", lpSrch="all users") returned 0x0 [0052.492] StrStrW (lpFirst="588bce7c90097ed212", lpSrch="appdata") returned 0x0 [0052.492] GetProcessHeap () returned 0x1130000 [0052.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0052.492] lstrcpyW (in: lpString1=0x118bf78, lpString2="\\\\?\\C:\\588bce7c90097ed212" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212") returned="\\\\?\\C:\\588bce7c90097ed212" [0052.492] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 4 [0052.492] QueueUserWorkItem (Function=0x129a680, Context=0x118bf78, Flags=0x0) returned 1 [0052.493] GetProcessHeap () returned 0x1130000 [0052.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0052.494] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\*") returned 27 [0052.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0052.495] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\.") returned 27 [0052.495] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.495] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.495] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.496] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\..") returned 28 [0052.496] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.496] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0052.496] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025") returned 30 [0052.496] lstrcmpW (lpString1="1025", lpString2="..") returned 1 [0052.496] lstrcmpW (lpString1="1025", lpString2=".") returned 1 [0052.496] StrStrW (lpFirst="1025", lpSrch="programdata") returned 0x0 [0052.496] StrStrW (lpFirst="1025", lpSrch="$recycle.bin") returned 0x0 [0052.496] StrStrW (lpFirst="1025", lpSrch="program files") returned 0x0 [0052.496] StrStrW (lpFirst="1025", lpSrch="windows") returned 0x0 [0052.496] StrStrW (lpFirst="1025", lpSrch="all users") returned 0x0 [0052.496] StrStrW (lpFirst="1025", lpSrch="appdata") returned 0x0 [0052.496] GetProcessHeap () returned 0x1130000 [0052.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0052.497] lstrcpyW (in: lpString1=0x11bdfa0, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1025" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1025") returned="\\\\?\\C:\\588bce7c90097ed212\\1025" [0052.497] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 5 [0052.497] QueueUserWorkItem (Function=0x129a680, Context=0x11bdfa0, Flags=0x0) returned 1 [0052.497] GetProcessHeap () returned 0x1130000 [0052.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0052.498] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\*") returned 32 [0052.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0052.498] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\.") returned 32 [0052.498] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.498] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.499] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.499] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\..") returned 33 [0052.499] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.499] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.499] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 39 [0052.499] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.499] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 48 [0052.499] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.499] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 49 [0052.499] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.499] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0052.499] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\read_me.txt") returned 42 [0052.499] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0052.499] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.499] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.500] CloseHandle (hObject=0x3b4) returned 1 [0052.501] GetProcessHeap () returned 0x1130000 [0052.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0052.501] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0052.501] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028") returned 30 [0052.501] lstrcmpW (lpString1="1028", lpString2="..") returned 1 [0052.501] lstrcmpW (lpString1="1028", lpString2=".") returned 1 [0052.502] StrStrW (lpFirst="1028", lpSrch="programdata") returned 0x0 [0052.502] StrStrW (lpFirst="1028", lpSrch="$recycle.bin") returned 0x0 [0052.502] StrStrW (lpFirst="1028", lpSrch="program files") returned 0x0 [0052.502] StrStrW (lpFirst="1028", lpSrch="windows") returned 0x0 [0052.502] StrStrW (lpFirst="1028", lpSrch="all users") returned 0x0 [0052.502] StrStrW (lpFirst="1028", lpSrch="appdata") returned 0x0 [0052.502] GetProcessHeap () returned 0x1130000 [0052.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0052.503] lstrcpyW (in: lpString1=0x11cdfa8, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1028" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1028") returned="\\\\?\\C:\\588bce7c90097ed212\\1028" [0052.503] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 6 [0052.503] QueueUserWorkItem (Function=0x129a680, Context=0x11cdfa8, Flags=0x0) returned 1 [0052.503] GetProcessHeap () returned 0x1130000 [0052.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0052.504] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\*") returned 32 [0052.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0052.505] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\.") returned 32 [0052.505] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.505] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.505] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.505] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\..") returned 33 [0052.505] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.505] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.505] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 39 [0052.505] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.505] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 48 [0052.505] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.505] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 49 [0052.505] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.505] FindClose (in: hFindFile=0x1170aa0 | out: hFindFile=0x1170aa0) returned 1 [0052.505] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\read_me.txt") returned 42 [0052.505] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0052.505] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.505] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.506] CloseHandle (hObject=0x3b4) returned 1 [0052.506] GetProcessHeap () returned 0x1130000 [0052.506] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0052.507] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0052.507] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029") returned 30 [0052.507] lstrcmpW (lpString1="1029", lpString2="..") returned 1 [0052.507] lstrcmpW (lpString1="1029", lpString2=".") returned 1 [0052.507] StrStrW (lpFirst="1029", lpSrch="programdata") returned 0x0 [0052.507] StrStrW (lpFirst="1029", lpSrch="$recycle.bin") returned 0x0 [0052.507] StrStrW (lpFirst="1029", lpSrch="program files") returned 0x0 [0052.507] StrStrW (lpFirst="1029", lpSrch="windows") returned 0x0 [0052.507] StrStrW (lpFirst="1029", lpSrch="all users") returned 0x0 [0052.507] StrStrW (lpFirst="1029", lpSrch="appdata") returned 0x0 [0052.508] GetProcessHeap () returned 0x1130000 [0052.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0052.509] lstrcpyW (in: lpString1=0x11ddfb0, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1029" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1029") returned="\\\\?\\C:\\588bce7c90097ed212\\1029" [0052.509] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 7 [0052.509] QueueUserWorkItem (Function=0x129a680, Context=0x11ddfb0, Flags=0x0) returned 1 [0052.509] GetProcessHeap () returned 0x1130000 [0052.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11edfb8 [0052.509] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\*") returned 32 [0052.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0052.510] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\.") returned 32 [0052.510] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.510] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.510] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.510] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\..") returned 33 [0052.510] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.510] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.510] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 39 [0052.510] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.510] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 48 [0052.510] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.510] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 49 [0052.510] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.510] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0052.511] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\read_me.txt") returned 42 [0052.511] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0052.511] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.511] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.512] CloseHandle (hObject=0x3b4) returned 1 [0052.512] GetProcessHeap () returned 0x1130000 [0052.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11edfb8 | out: hHeap=0x1130000) returned 1 [0052.513] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0052.513] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030") returned 30 [0052.513] lstrcmpW (lpString1="1030", lpString2="..") returned 1 [0052.513] lstrcmpW (lpString1="1030", lpString2=".") returned 1 [0052.513] StrStrW (lpFirst="1030", lpSrch="programdata") returned 0x0 [0052.513] StrStrW (lpFirst="1030", lpSrch="$recycle.bin") returned 0x0 [0052.513] StrStrW (lpFirst="1030", lpSrch="program files") returned 0x0 [0052.513] StrStrW (lpFirst="1030", lpSrch="windows") returned 0x0 [0052.513] StrStrW (lpFirst="1030", lpSrch="all users") returned 0x0 [0052.513] StrStrW (lpFirst="1030", lpSrch="appdata") returned 0x0 [0052.513] GetProcessHeap () returned 0x1130000 [0052.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11edfb8 [0052.514] lstrcpyW (in: lpString1=0x11edfb8, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1030" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1030") returned="\\\\?\\C:\\588bce7c90097ed212\\1030" [0052.514] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 8 [0052.514] QueueUserWorkItem (Function=0x129a680, Context=0x11edfb8, Flags=0x0) returned 1 [0052.514] GetProcessHeap () returned 0x1130000 [0052.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0052.515] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\*") returned 32 [0052.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0052.515] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\.") returned 32 [0052.515] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.515] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.515] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.515] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\..") returned 33 [0052.516] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.516] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.516] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 39 [0052.516] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.516] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 48 [0052.516] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.516] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 49 [0052.516] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.516] FindClose (in: hFindFile=0x1170ba0 | out: hFindFile=0x1170ba0) returned 1 [0052.516] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\read_me.txt") returned 42 [0052.516] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0052.516] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.516] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.517] CloseHandle (hObject=0x3b4) returned 1 [0052.517] GetProcessHeap () returned 0x1130000 [0052.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0052.518] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0052.518] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031") returned 30 [0052.518] lstrcmpW (lpString1="1031", lpString2="..") returned 1 [0052.518] lstrcmpW (lpString1="1031", lpString2=".") returned 1 [0052.518] StrStrW (lpFirst="1031", lpSrch="programdata") returned 0x0 [0052.518] StrStrW (lpFirst="1031", lpSrch="$recycle.bin") returned 0x0 [0052.518] StrStrW (lpFirst="1031", lpSrch="program files") returned 0x0 [0052.518] StrStrW (lpFirst="1031", lpSrch="windows") returned 0x0 [0052.518] StrStrW (lpFirst="1031", lpSrch="all users") returned 0x0 [0052.518] StrStrW (lpFirst="1031", lpSrch="appdata") returned 0x0 [0052.518] GetProcessHeap () returned 0x1130000 [0052.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0052.519] lstrcpyW (in: lpString1=0x11fdfc0, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1031" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1031") returned="\\\\?\\C:\\588bce7c90097ed212\\1031" [0052.519] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 9 [0052.519] QueueUserWorkItem (Function=0x129a680, Context=0x11fdfc0, Flags=0x0) returned 1 [0052.519] GetProcessHeap () returned 0x1130000 [0052.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0052.520] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\*") returned 32 [0052.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.682] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\.") returned 32 [0052.682] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.682] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.682] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\..") returned 33 [0052.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.682] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.682] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 39 [0052.682] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.682] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 48 [0052.683] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.683] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 49 [0052.683] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.683] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.683] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\read_me.txt") returned 42 [0052.683] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0052.685] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.685] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.686] CloseHandle (hObject=0x3c0) returned 1 [0052.686] GetProcessHeap () returned 0x1130000 [0052.686] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0052.687] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0052.687] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032") returned 30 [0052.687] lstrcmpW (lpString1="1032", lpString2="..") returned 1 [0052.687] lstrcmpW (lpString1="1032", lpString2=".") returned 1 [0052.687] StrStrW (lpFirst="1032", lpSrch="programdata") returned 0x0 [0052.687] StrStrW (lpFirst="1032", lpSrch="$recycle.bin") returned 0x0 [0052.687] StrStrW (lpFirst="1032", lpSrch="program files") returned 0x0 [0052.687] StrStrW (lpFirst="1032", lpSrch="windows") returned 0x0 [0052.687] StrStrW (lpFirst="1032", lpSrch="all users") returned 0x0 [0052.687] StrStrW (lpFirst="1032", lpSrch="appdata") returned 0x0 [0052.687] GetProcessHeap () returned 0x1130000 [0052.687] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0052.688] lstrcpyW (in: lpString1=0x120dfc8, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1032" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1032") returned="\\\\?\\C:\\588bce7c90097ed212\\1032" [0052.688] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 10 [0052.688] QueueUserWorkItem (Function=0x129a680, Context=0x120dfc8, Flags=0x0) returned 1 [0052.688] GetProcessHeap () returned 0x1130000 [0052.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0052.689] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\*") returned 32 [0052.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.690] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\.") returned 32 [0052.690] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.690] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.690] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.690] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\..") returned 33 [0052.690] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.690] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.690] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 39 [0052.690] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.690] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 48 [0052.690] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.690] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 49 [0052.690] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.690] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.690] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\read_me.txt") returned 42 [0052.690] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0052.690] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.690] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.691] CloseHandle (hObject=0x3c0) returned 1 [0052.691] GetProcessHeap () returned 0x1130000 [0052.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0052.692] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0052.692] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033") returned 30 [0052.692] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0052.692] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0052.692] StrStrW (lpFirst="1033", lpSrch="programdata") returned 0x0 [0052.692] StrStrW (lpFirst="1033", lpSrch="$recycle.bin") returned 0x0 [0052.692] StrStrW (lpFirst="1033", lpSrch="program files") returned 0x0 [0052.692] StrStrW (lpFirst="1033", lpSrch="windows") returned 0x0 [0052.692] StrStrW (lpFirst="1033", lpSrch="all users") returned 0x0 [0052.692] StrStrW (lpFirst="1033", lpSrch="appdata") returned 0x0 [0052.692] GetProcessHeap () returned 0x1130000 [0052.692] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0052.693] lstrcpyW (in: lpString1=0x11bdfa0, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1033" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1033") returned="\\\\?\\C:\\588bce7c90097ed212\\1033" [0052.693] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 11 [0052.693] QueueUserWorkItem (Function=0x129a680, Context=0x11bdfa0, Flags=0x0) returned 1 [0052.693] GetProcessHeap () returned 0x1130000 [0052.693] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0052.694] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\*") returned 32 [0052.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.695] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\.") returned 32 [0052.695] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.695] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.695] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.695] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\..") returned 33 [0052.695] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.695] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.695] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 39 [0052.695] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.695] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 48 [0052.695] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.695] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 49 [0052.695] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.695] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.695] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\read_me.txt") returned 42 [0052.695] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.697] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.697] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.698] CloseHandle (hObject=0x3bc) returned 1 [0052.698] GetProcessHeap () returned 0x1130000 [0052.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0052.699] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0052.699] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035") returned 30 [0052.699] lstrcmpW (lpString1="1035", lpString2="..") returned 1 [0052.699] lstrcmpW (lpString1="1035", lpString2=".") returned 1 [0052.699] StrStrW (lpFirst="1035", lpSrch="programdata") returned 0x0 [0052.699] StrStrW (lpFirst="1035", lpSrch="$recycle.bin") returned 0x0 [0052.699] StrStrW (lpFirst="1035", lpSrch="program files") returned 0x0 [0052.699] StrStrW (lpFirst="1035", lpSrch="windows") returned 0x0 [0052.699] StrStrW (lpFirst="1035", lpSrch="all users") returned 0x0 [0052.699] StrStrW (lpFirst="1035", lpSrch="appdata") returned 0x0 [0052.699] GetProcessHeap () returned 0x1130000 [0052.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0052.700] lstrcpyW (in: lpString1=0x3600058, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1035" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1035") returned="\\\\?\\C:\\588bce7c90097ed212\\1035" [0052.700] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 12 [0052.700] QueueUserWorkItem (Function=0x129a680, Context=0x3600058, Flags=0x0) returned 1 [0052.700] GetProcessHeap () returned 0x1130000 [0052.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0052.701] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\*") returned 32 [0052.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b20 [0052.703] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\.") returned 32 [0052.703] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.703] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.703] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.703] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\..") returned 33 [0052.703] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.703] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.703] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 39 [0052.703] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.703] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 48 [0052.703] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.703] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 49 [0052.703] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.703] FindClose (in: hFindFile=0x1170b20 | out: hFindFile=0x1170b20) returned 1 [0052.703] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\read_me.txt") returned 42 [0052.703] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0052.703] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.703] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.705] CloseHandle (hObject=0x3c0) returned 1 [0052.705] GetProcessHeap () returned 0x1130000 [0052.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0052.705] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0052.705] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036") returned 30 [0052.705] lstrcmpW (lpString1="1036", lpString2="..") returned 1 [0052.705] lstrcmpW (lpString1="1036", lpString2=".") returned 1 [0052.705] StrStrW (lpFirst="1036", lpSrch="programdata") returned 0x0 [0052.705] StrStrW (lpFirst="1036", lpSrch="$recycle.bin") returned 0x0 [0052.705] StrStrW (lpFirst="1036", lpSrch="program files") returned 0x0 [0052.705] StrStrW (lpFirst="1036", lpSrch="windows") returned 0x0 [0052.705] StrStrW (lpFirst="1036", lpSrch="all users") returned 0x0 [0052.705] StrStrW (lpFirst="1036", lpSrch="appdata") returned 0x0 [0052.705] GetProcessHeap () returned 0x1130000 [0052.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0052.705] lstrcpyW (in: lpString1=0x11cdfa8, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1036" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1036") returned="\\\\?\\C:\\588bce7c90097ed212\\1036" [0052.705] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 13 [0052.705] QueueUserWorkItem (Function=0x129a680, Context=0x11cdfa8, Flags=0x0) returned 1 [0052.705] GetProcessHeap () returned 0x1130000 [0052.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3610060 [0052.706] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\*") returned 32 [0052.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.707] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\.") returned 32 [0052.707] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.707] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.707] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.707] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\..") returned 33 [0052.707] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.707] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.707] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 39 [0052.707] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.707] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 48 [0052.707] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.707] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 49 [0052.707] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.707] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.707] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\read_me.txt") returned 42 [0052.707] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.708] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.708] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.709] CloseHandle (hObject=0x3bc) returned 1 [0052.709] GetProcessHeap () returned 0x1130000 [0052.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3610060 | out: hHeap=0x1130000) returned 1 [0052.709] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0052.709] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037") returned 30 [0052.709] lstrcmpW (lpString1="1037", lpString2="..") returned 1 [0052.709] lstrcmpW (lpString1="1037", lpString2=".") returned 1 [0052.709] StrStrW (lpFirst="1037", lpSrch="programdata") returned 0x0 [0052.709] StrStrW (lpFirst="1037", lpSrch="$recycle.bin") returned 0x0 [0052.709] StrStrW (lpFirst="1037", lpSrch="program files") returned 0x0 [0052.709] StrStrW (lpFirst="1037", lpSrch="windows") returned 0x0 [0052.709] StrStrW (lpFirst="1037", lpSrch="all users") returned 0x0 [0052.709] StrStrW (lpFirst="1037", lpSrch="appdata") returned 0x0 [0052.709] GetProcessHeap () returned 0x1130000 [0052.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3610060 [0052.709] lstrcpyW (in: lpString1=0x3610060, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1037" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1037") returned="\\\\?\\C:\\588bce7c90097ed212\\1037" [0052.709] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 14 [0052.709] QueueUserWorkItem (Function=0x129a680, Context=0x3610060, Flags=0x0) returned 1 [0052.709] GetProcessHeap () returned 0x1130000 [0052.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3620068 [0052.710] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\*") returned 32 [0052.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.711] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\.") returned 32 [0052.711] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.711] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.711] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.711] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\..") returned 33 [0052.711] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.711] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.711] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 39 [0052.711] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.711] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 48 [0052.711] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.711] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 49 [0052.711] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.711] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.711] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\read_me.txt") returned 42 [0052.711] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.712] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.712] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.712] CloseHandle (hObject=0x3bc) returned 1 [0052.713] GetProcessHeap () returned 0x1130000 [0052.713] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3620068 | out: hHeap=0x1130000) returned 1 [0052.713] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0052.713] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038") returned 30 [0052.713] lstrcmpW (lpString1="1038", lpString2="..") returned 1 [0052.713] lstrcmpW (lpString1="1038", lpString2=".") returned 1 [0052.713] StrStrW (lpFirst="1038", lpSrch="programdata") returned 0x0 [0052.714] StrStrW (lpFirst="1038", lpSrch="$recycle.bin") returned 0x0 [0052.714] StrStrW (lpFirst="1038", lpSrch="program files") returned 0x0 [0052.714] StrStrW (lpFirst="1038", lpSrch="windows") returned 0x0 [0052.714] StrStrW (lpFirst="1038", lpSrch="all users") returned 0x0 [0052.714] StrStrW (lpFirst="1038", lpSrch="appdata") returned 0x0 [0052.714] GetProcessHeap () returned 0x1130000 [0052.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0052.714] lstrcpyW (in: lpString1=0x11ddfb0, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1038" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1038") returned="\\\\?\\C:\\588bce7c90097ed212\\1038" [0052.714] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 15 [0052.715] QueueUserWorkItem (Function=0x129a680, Context=0x11ddfb0, Flags=0x0) returned 1 [0052.715] GetProcessHeap () returned 0x1130000 [0052.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3620068 [0052.715] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\*") returned 32 [0052.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.717] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\.") returned 32 [0052.717] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0052.717] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.717] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.717] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\..") returned 33 [0052.717] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.717] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.717] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 39 [0052.717] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.718] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 48 [0052.718] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.718] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 49 [0052.718] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.718] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.718] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\read_me.txt") returned 42 [0052.718] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.720] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0052.720] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0052.720] CloseHandle (hObject=0x3bc) returned 1 [0052.721] GetProcessHeap () returned 0x1130000 [0052.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3620068 | out: hHeap=0x1130000) returned 1 [0052.721] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0052.721] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040") returned 30 [0052.721] lstrcmpW (lpString1="1040", lpString2="..") returned 1 [0052.721] lstrcmpW (lpString1="1040", lpString2=".") returned 1 [0052.721] StrStrW (lpFirst="1040", lpSrch="programdata") returned 0x0 [0052.722] StrStrW (lpFirst="1040", lpSrch="$recycle.bin") returned 0x0 [0052.722] StrStrW (lpFirst="1040", lpSrch="program files") returned 0x0 [0052.722] StrStrW (lpFirst="1040", lpSrch="windows") returned 0x0 [0052.722] StrStrW (lpFirst="1040", lpSrch="all users") returned 0x0 [0052.722] StrStrW (lpFirst="1040", lpSrch="appdata") returned 0x0 [0052.722] GetProcessHeap () returned 0x1130000 [0052.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3620068 [0052.723] lstrcpyW (in: lpString1=0x3620068, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1040" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1040") returned="\\\\?\\C:\\588bce7c90097ed212\\1040" [0052.723] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 16 [0052.723] QueueUserWorkItem (Function=0x129a680, Context=0x3620068, Flags=0x0) returned 1 [0052.723] GetProcessHeap () returned 0x1130000 [0052.723] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0052.723] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\*") returned 32 [0052.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b20 [0053.036] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\.") returned 32 [0053.036] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.036] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.036] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.036] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\..") returned 33 [0053.036] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.036] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.036] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 39 [0053.036] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.036] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 48 [0053.036] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.036] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 49 [0053.036] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.036] FindClose (in: hFindFile=0x1170b20 | out: hFindFile=0x1170b20) returned 1 [0053.036] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\read_me.txt") returned 42 [0053.036] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.037] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.037] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.038] CloseHandle (hObject=0x3bc) returned 1 [0053.038] GetProcessHeap () returned 0x1130000 [0053.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0053.038] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0053.038] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041") returned 30 [0053.038] lstrcmpW (lpString1="1041", lpString2="..") returned 1 [0053.038] lstrcmpW (lpString1="1041", lpString2=".") returned 1 [0053.038] StrStrW (lpFirst="1041", lpSrch="programdata") returned 0x0 [0053.038] StrStrW (lpFirst="1041", lpSrch="$recycle.bin") returned 0x0 [0053.038] StrStrW (lpFirst="1041", lpSrch="program files") returned 0x0 [0053.038] StrStrW (lpFirst="1041", lpSrch="windows") returned 0x0 [0053.038] StrStrW (lpFirst="1041", lpSrch="all users") returned 0x0 [0053.038] StrStrW (lpFirst="1041", lpSrch="appdata") returned 0x0 [0053.038] GetProcessHeap () returned 0x1130000 [0053.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0053.038] lstrcpyW (in: lpString1=0x3630070, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1041" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1041") returned="\\\\?\\C:\\588bce7c90097ed212\\1041" [0053.038] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 17 [0053.038] QueueUserWorkItem (Function=0x129a680, Context=0x3630070, Flags=0x0) returned 1 [0053.038] GetProcessHeap () returned 0x1130000 [0053.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3650080 [0053.039] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\*") returned 32 [0053.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.041] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\.") returned 32 [0053.041] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.041] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.041] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.041] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\..") returned 33 [0053.041] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.041] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.041] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 39 [0053.041] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.041] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 48 [0053.041] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.041] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 49 [0053.041] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.041] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.044] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\read_me.txt") returned 42 [0053.044] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.045] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.045] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.046] CloseHandle (hObject=0x3b0) returned 1 [0053.046] GetProcessHeap () returned 0x1130000 [0053.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3650080 | out: hHeap=0x1130000) returned 1 [0053.047] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0053.047] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042") returned 30 [0053.047] lstrcmpW (lpString1="1042", lpString2="..") returned 1 [0053.047] lstrcmpW (lpString1="1042", lpString2=".") returned 1 [0053.047] StrStrW (lpFirst="1042", lpSrch="programdata") returned 0x0 [0053.047] StrStrW (lpFirst="1042", lpSrch="$recycle.bin") returned 0x0 [0053.047] StrStrW (lpFirst="1042", lpSrch="program files") returned 0x0 [0053.047] StrStrW (lpFirst="1042", lpSrch="windows") returned 0x0 [0053.047] StrStrW (lpFirst="1042", lpSrch="all users") returned 0x0 [0053.047] StrStrW (lpFirst="1042", lpSrch="appdata") returned 0x0 [0053.047] GetProcessHeap () returned 0x1130000 [0053.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0053.048] lstrcpyW (in: lpString1=0x3640078, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1042" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1042") returned="\\\\?\\C:\\588bce7c90097ed212\\1042" [0053.048] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 18 [0053.048] QueueUserWorkItem (Function=0x129a680, Context=0x3640078, Flags=0x0) returned 1 [0053.048] GetProcessHeap () returned 0x1130000 [0053.048] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3650080 [0053.049] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\*") returned 32 [0053.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.051] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\.") returned 32 [0053.051] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.051] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.051] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.051] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\..") returned 33 [0053.051] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.051] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.051] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 39 [0053.051] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.051] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 48 [0053.051] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.051] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 49 [0053.051] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.051] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.051] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\read_me.txt") returned 42 [0053.051] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.053] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.053] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.054] CloseHandle (hObject=0x3b0) returned 1 [0053.054] GetProcessHeap () returned 0x1130000 [0053.054] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3650080 | out: hHeap=0x1130000) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0053.055] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043") returned 30 [0053.055] lstrcmpW (lpString1="1043", lpString2="..") returned 1 [0053.055] lstrcmpW (lpString1="1043", lpString2=".") returned 1 [0053.055] StrStrW (lpFirst="1043", lpSrch="programdata") returned 0x0 [0053.055] StrStrW (lpFirst="1043", lpSrch="$recycle.bin") returned 0x0 [0053.055] StrStrW (lpFirst="1043", lpSrch="program files") returned 0x0 [0053.055] StrStrW (lpFirst="1043", lpSrch="windows") returned 0x0 [0053.055] StrStrW (lpFirst="1043", lpSrch="all users") returned 0x0 [0053.055] StrStrW (lpFirst="1043", lpSrch="appdata") returned 0x0 [0053.055] GetProcessHeap () returned 0x1130000 [0053.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3650080 [0053.056] lstrcpyW (in: lpString1=0x3650080, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1043" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1043") returned="\\\\?\\C:\\588bce7c90097ed212\\1043" [0053.056] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 19 [0053.056] QueueUserWorkItem (Function=0x129a680, Context=0x3650080, Flags=0x0) returned 1 [0053.056] GetProcessHeap () returned 0x1130000 [0053.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3660088 [0053.056] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\*") returned 32 [0053.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c60 [0053.057] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\.") returned 32 [0053.057] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.057] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.057] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.057] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\..") returned 33 [0053.057] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.057] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.057] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 39 [0053.057] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.057] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 48 [0053.057] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.057] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 49 [0053.057] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.057] FindClose (in: hFindFile=0x1170c60 | out: hFindFile=0x1170c60) returned 1 [0053.057] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\read_me.txt") returned 42 [0053.057] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.064] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.064] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.064] CloseHandle (hObject=0x3bc) returned 1 [0053.065] GetProcessHeap () returned 0x1130000 [0053.065] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3660088 | out: hHeap=0x1130000) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0053.065] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044") returned 30 [0053.065] lstrcmpW (lpString1="1044", lpString2="..") returned 1 [0053.065] lstrcmpW (lpString1="1044", lpString2=".") returned 1 [0053.065] StrStrW (lpFirst="1044", lpSrch="programdata") returned 0x0 [0053.065] StrStrW (lpFirst="1044", lpSrch="$recycle.bin") returned 0x0 [0053.065] StrStrW (lpFirst="1044", lpSrch="program files") returned 0x0 [0053.065] StrStrW (lpFirst="1044", lpSrch="windows") returned 0x0 [0053.065] StrStrW (lpFirst="1044", lpSrch="all users") returned 0x0 [0053.065] StrStrW (lpFirst="1044", lpSrch="appdata") returned 0x0 [0053.065] GetProcessHeap () returned 0x1130000 [0053.065] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3660088 [0053.066] lstrcpyW (in: lpString1=0x3660088, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1044" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1044") returned="\\\\?\\C:\\588bce7c90097ed212\\1044" [0053.066] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 20 [0053.066] QueueUserWorkItem (Function=0x129a680, Context=0x3660088, Flags=0x0) returned 1 [0053.066] GetProcessHeap () returned 0x1130000 [0053.066] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3670090 [0053.066] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\*") returned 32 [0053.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0053.070] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\.") returned 32 [0053.070] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.070] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.070] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.070] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\..") returned 33 [0053.070] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.070] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.070] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 39 [0053.070] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.070] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 48 [0053.071] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.071] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 49 [0053.071] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.071] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0053.071] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\read_me.txt") returned 42 [0053.071] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.071] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.071] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.072] CloseHandle (hObject=0x3b0) returned 1 [0053.072] GetProcessHeap () returned 0x1130000 [0053.072] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3670090 | out: hHeap=0x1130000) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0053.073] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045") returned 30 [0053.073] lstrcmpW (lpString1="1045", lpString2="..") returned 1 [0053.073] lstrcmpW (lpString1="1045", lpString2=".") returned 1 [0053.073] StrStrW (lpFirst="1045", lpSrch="programdata") returned 0x0 [0053.073] StrStrW (lpFirst="1045", lpSrch="$recycle.bin") returned 0x0 [0053.074] StrStrW (lpFirst="1045", lpSrch="program files") returned 0x0 [0053.074] StrStrW (lpFirst="1045", lpSrch="windows") returned 0x0 [0053.074] StrStrW (lpFirst="1045", lpSrch="all users") returned 0x0 [0053.074] StrStrW (lpFirst="1045", lpSrch="appdata") returned 0x0 [0053.074] GetProcessHeap () returned 0x1130000 [0053.074] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0053.074] lstrcpyW (in: lpString1=0x35f0050, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1045" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1045") returned="\\\\?\\C:\\588bce7c90097ed212\\1045" [0053.074] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 21 [0053.074] QueueUserWorkItem (Function=0x129a680, Context=0x35f0050, Flags=0x0) returned 1 [0053.074] GetProcessHeap () returned 0x1130000 [0053.075] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3670090 [0053.075] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\*") returned 32 [0053.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0053.078] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\.") returned 32 [0053.078] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.078] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.078] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.079] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\..") returned 33 [0053.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.079] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.079] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 39 [0053.079] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.079] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 48 [0053.079] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.079] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 49 [0053.079] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.079] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0053.079] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\read_me.txt") returned 42 [0053.079] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.080] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.080] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.081] CloseHandle (hObject=0x3b0) returned 1 [0053.081] GetProcessHeap () returned 0x1130000 [0053.081] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3670090 | out: hHeap=0x1130000) returned 1 [0053.082] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0053.082] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046") returned 30 [0053.082] lstrcmpW (lpString1="1046", lpString2="..") returned 1 [0053.082] lstrcmpW (lpString1="1046", lpString2=".") returned 1 [0053.082] StrStrW (lpFirst="1046", lpSrch="programdata") returned 0x0 [0053.082] StrStrW (lpFirst="1046", lpSrch="$recycle.bin") returned 0x0 [0053.082] StrStrW (lpFirst="1046", lpSrch="program files") returned 0x0 [0053.082] StrStrW (lpFirst="1046", lpSrch="windows") returned 0x0 [0053.082] StrStrW (lpFirst="1046", lpSrch="all users") returned 0x0 [0053.082] StrStrW (lpFirst="1046", lpSrch="appdata") returned 0x0 [0053.082] GetProcessHeap () returned 0x1130000 [0053.082] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3670090 [0053.084] lstrcpyW (in: lpString1=0x3670090, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1046" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1046") returned="\\\\?\\C:\\588bce7c90097ed212\\1046" [0053.084] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 22 [0053.084] QueueUserWorkItem (Function=0x129a680, Context=0x3670090, Flags=0x0) returned 1 [0053.084] GetProcessHeap () returned 0x1130000 [0053.084] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.084] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\*") returned 32 [0053.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0053.111] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\.") returned 32 [0053.111] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.111] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.111] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.111] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\..") returned 33 [0053.111] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.111] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.111] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 39 [0053.111] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.111] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 48 [0053.111] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.111] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 49 [0053.111] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.111] FindClose (in: hFindFile=0x1170ba0 | out: hFindFile=0x1170ba0) returned 1 [0053.112] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\read_me.txt") returned 42 [0053.112] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.112] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.112] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.113] CloseHandle (hObject=0x3b0) returned 1 [0053.113] GetProcessHeap () returned 0x1130000 [0053.113] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.113] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0053.113] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049") returned 30 [0053.113] lstrcmpW (lpString1="1049", lpString2="..") returned 1 [0053.113] lstrcmpW (lpString1="1049", lpString2=".") returned 1 [0053.113] StrStrW (lpFirst="1049", lpSrch="programdata") returned 0x0 [0053.113] StrStrW (lpFirst="1049", lpSrch="$recycle.bin") returned 0x0 [0053.113] StrStrW (lpFirst="1049", lpSrch="program files") returned 0x0 [0053.113] StrStrW (lpFirst="1049", lpSrch="windows") returned 0x0 [0053.113] StrStrW (lpFirst="1049", lpSrch="all users") returned 0x0 [0053.113] StrStrW (lpFirst="1049", lpSrch="appdata") returned 0x0 [0053.113] GetProcessHeap () returned 0x1130000 [0053.113] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.113] lstrcpyW (in: lpString1=0x3680098, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1049" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1049") returned="\\\\?\\C:\\588bce7c90097ed212\\1049" [0053.113] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 23 [0053.113] QueueUserWorkItem (Function=0x129a680, Context=0x3680098, Flags=0x0) returned 1 [0053.113] GetProcessHeap () returned 0x1130000 [0053.113] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11edfb8 [0053.114] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\*") returned 32 [0053.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.115] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\.") returned 32 [0053.115] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.115] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.115] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.115] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\..") returned 33 [0053.115] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.115] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.115] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 39 [0053.115] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.116] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 48 [0053.116] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.116] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 49 [0053.116] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.116] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.116] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\read_me.txt") returned 42 [0053.116] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.118] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.118] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.119] CloseHandle (hObject=0x3b4) returned 1 [0053.119] GetProcessHeap () returned 0x1130000 [0053.119] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11edfb8 | out: hHeap=0x1130000) returned 1 [0053.120] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0053.120] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053") returned 30 [0053.120] lstrcmpW (lpString1="1053", lpString2="..") returned 1 [0053.120] lstrcmpW (lpString1="1053", lpString2=".") returned 1 [0053.120] StrStrW (lpFirst="1053", lpSrch="programdata") returned 0x0 [0053.120] StrStrW (lpFirst="1053", lpSrch="$recycle.bin") returned 0x0 [0053.120] StrStrW (lpFirst="1053", lpSrch="program files") returned 0x0 [0053.121] StrStrW (lpFirst="1053", lpSrch="windows") returned 0x0 [0053.121] StrStrW (lpFirst="1053", lpSrch="all users") returned 0x0 [0053.121] StrStrW (lpFirst="1053", lpSrch="appdata") returned 0x0 [0053.121] GetProcessHeap () returned 0x1130000 [0053.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36a00a8 [0053.121] lstrcpyW (in: lpString1=0x36a00a8, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1053" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1053") returned="\\\\?\\C:\\588bce7c90097ed212\\1053" [0053.122] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 24 [0053.122] QueueUserWorkItem (Function=0x129a680, Context=0x36a00a8, Flags=0x0) returned 1 [0053.122] GetProcessHeap () returned 0x1130000 [0053.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11edfb8 [0053.122] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\*") returned 32 [0053.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.125] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\.") returned 32 [0053.125] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.125] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.125] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.125] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\..") returned 33 [0053.125] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.125] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.125] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 39 [0053.125] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.125] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 48 [0053.125] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.125] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 49 [0053.125] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.125] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.125] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\read_me.txt") returned 42 [0053.125] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.126] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.126] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.127] CloseHandle (hObject=0x3b0) returned 1 [0053.127] GetProcessHeap () returned 0x1130000 [0053.127] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11edfb8 | out: hHeap=0x1130000) returned 1 [0053.127] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0053.127] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055") returned 30 [0053.127] lstrcmpW (lpString1="1055", lpString2="..") returned 1 [0053.127] lstrcmpW (lpString1="1055", lpString2=".") returned 1 [0053.127] StrStrW (lpFirst="1055", lpSrch="programdata") returned 0x0 [0053.127] StrStrW (lpFirst="1055", lpSrch="$recycle.bin") returned 0x0 [0053.127] StrStrW (lpFirst="1055", lpSrch="program files") returned 0x0 [0053.127] StrStrW (lpFirst="1055", lpSrch="windows") returned 0x0 [0053.127] StrStrW (lpFirst="1055", lpSrch="all users") returned 0x0 [0053.127] StrStrW (lpFirst="1055", lpSrch="appdata") returned 0x0 [0053.127] GetProcessHeap () returned 0x1130000 [0053.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11edfb8 [0053.127] lstrcpyW (in: lpString1=0x11edfb8, lpString2="\\\\?\\C:\\588bce7c90097ed212\\1055" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1055") returned="\\\\?\\C:\\588bce7c90097ed212\\1055" [0053.127] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 25 [0053.127] QueueUserWorkItem (Function=0x129a680, Context=0x11edfb8, Flags=0x0) returned 1 [0053.127] GetProcessHeap () returned 0x1130000 [0053.127] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36b00b0 [0053.128] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\*") returned 32 [0053.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.129] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\.") returned 32 [0053.129] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.129] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.129] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.129] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\..") returned 33 [0053.129] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.129] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.129] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 39 [0053.129] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.129] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 48 [0053.129] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.129] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 49 [0053.129] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.129] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.129] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\read_me.txt") returned 42 [0053.129] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.129] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.130] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.130] CloseHandle (hObject=0x3b4) returned 1 [0053.130] GetProcessHeap () returned 0x1130000 [0053.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36b00b0 | out: hHeap=0x1130000) returned 1 [0053.131] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0053.131] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052") returned 30 [0053.131] lstrcmpW (lpString1="2052", lpString2="..") returned 1 [0053.131] lstrcmpW (lpString1="2052", lpString2=".") returned 1 [0053.131] StrStrW (lpFirst="2052", lpSrch="programdata") returned 0x0 [0053.131] StrStrW (lpFirst="2052", lpSrch="$recycle.bin") returned 0x0 [0053.131] StrStrW (lpFirst="2052", lpSrch="program files") returned 0x0 [0053.131] StrStrW (lpFirst="2052", lpSrch="windows") returned 0x0 [0053.131] StrStrW (lpFirst="2052", lpSrch="all users") returned 0x0 [0053.131] StrStrW (lpFirst="2052", lpSrch="appdata") returned 0x0 [0053.131] GetProcessHeap () returned 0x1130000 [0053.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36b00b0 [0053.131] lstrcpyW (in: lpString1=0x36b00b0, lpString2="\\\\?\\C:\\588bce7c90097ed212\\2052" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\2052") returned="\\\\?\\C:\\588bce7c90097ed212\\2052" [0053.131] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 26 [0053.131] QueueUserWorkItem (Function=0x129a680, Context=0x36b00b0, Flags=0x0) returned 1 [0053.131] GetProcessHeap () returned 0x1130000 [0053.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37e0048 [0053.132] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\*") returned 32 [0053.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.132] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\.") returned 32 [0053.133] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.133] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.133] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.133] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\..") returned 33 [0053.133] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.133] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.133] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 39 [0053.133] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.133] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 48 [0053.133] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.133] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 49 [0053.133] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.133] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.133] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\read_me.txt") returned 42 [0053.133] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.133] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.133] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.134] CloseHandle (hObject=0x3b4) returned 1 [0053.134] GetProcessHeap () returned 0x1130000 [0053.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37e0048 | out: hHeap=0x1130000) returned 1 [0053.135] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0053.135] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070") returned 30 [0053.135] lstrcmpW (lpString1="2070", lpString2="..") returned 1 [0053.135] lstrcmpW (lpString1="2070", lpString2=".") returned 1 [0053.135] StrStrW (lpFirst="2070", lpSrch="programdata") returned 0x0 [0053.135] StrStrW (lpFirst="2070", lpSrch="$recycle.bin") returned 0x0 [0053.135] StrStrW (lpFirst="2070", lpSrch="program files") returned 0x0 [0053.135] StrStrW (lpFirst="2070", lpSrch="windows") returned 0x0 [0053.135] StrStrW (lpFirst="2070", lpSrch="all users") returned 0x0 [0053.136] StrStrW (lpFirst="2070", lpSrch="appdata") returned 0x0 [0053.136] GetProcessHeap () returned 0x1130000 [0053.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0053.136] lstrcpyW (in: lpString1=0x11fdfc0, lpString2="\\\\?\\C:\\588bce7c90097ed212\\2070" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\2070") returned="\\\\?\\C:\\588bce7c90097ed212\\2070" [0053.136] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 27 [0053.136] QueueUserWorkItem (Function=0x129a680, Context=0x11fdfc0, Flags=0x0) returned 1 [0053.136] GetProcessHeap () returned 0x1130000 [0053.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37e0048 [0053.137] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\*") returned 32 [0053.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.139] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\.") returned 32 [0053.139] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.139] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.139] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.139] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\..") returned 33 [0053.140] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.140] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.140] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 39 [0053.140] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.140] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 48 [0053.140] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.140] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 49 [0053.140] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.140] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.140] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\read_me.txt") returned 42 [0053.140] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.143] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.143] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.144] CloseHandle (hObject=0x3b4) returned 1 [0053.144] GetProcessHeap () returned 0x1130000 [0053.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37e0048 | out: hHeap=0x1130000) returned 1 [0053.145] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0053.145] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076") returned 30 [0053.145] lstrcmpW (lpString1="3076", lpString2="..") returned 1 [0053.145] lstrcmpW (lpString1="3076", lpString2=".") returned 1 [0053.145] StrStrW (lpFirst="3076", lpSrch="programdata") returned 0x0 [0053.145] StrStrW (lpFirst="3076", lpSrch="$recycle.bin") returned 0x0 [0053.145] StrStrW (lpFirst="3076", lpSrch="program files") returned 0x0 [0053.145] StrStrW (lpFirst="3076", lpSrch="windows") returned 0x0 [0053.145] StrStrW (lpFirst="3076", lpSrch="all users") returned 0x0 [0053.145] StrStrW (lpFirst="3076", lpSrch="appdata") returned 0x0 [0053.145] GetProcessHeap () returned 0x1130000 [0053.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37e0048 [0053.146] lstrcpyW (in: lpString1=0x37e0048, lpString2="\\\\?\\C:\\588bce7c90097ed212\\3076" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\3076") returned="\\\\?\\C:\\588bce7c90097ed212\\3076" [0053.146] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 28 [0053.146] QueueUserWorkItem (Function=0x129a680, Context=0x37e0048, Flags=0x0) returned 1 [0053.146] GetProcessHeap () returned 0x1130000 [0053.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37f0050 [0053.147] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\*") returned 32 [0053.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0053.149] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\.") returned 32 [0053.149] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.149] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.149] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.149] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\..") returned 33 [0053.149] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.149] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.149] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 39 [0053.149] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.149] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 48 [0053.149] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.149] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 49 [0053.149] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.149] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0053.149] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\read_me.txt") returned 42 [0053.150] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.150] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.150] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.151] CloseHandle (hObject=0x3b0) returned 1 [0053.151] GetProcessHeap () returned 0x1130000 [0053.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37f0050 | out: hHeap=0x1130000) returned 1 [0053.151] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0053.151] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082") returned 30 [0053.151] lstrcmpW (lpString1="3082", lpString2="..") returned 1 [0053.151] lstrcmpW (lpString1="3082", lpString2=".") returned 1 [0053.151] StrStrW (lpFirst="3082", lpSrch="programdata") returned 0x0 [0053.151] StrStrW (lpFirst="3082", lpSrch="$recycle.bin") returned 0x0 [0053.151] StrStrW (lpFirst="3082", lpSrch="program files") returned 0x0 [0053.151] StrStrW (lpFirst="3082", lpSrch="windows") returned 0x0 [0053.151] StrStrW (lpFirst="3082", lpSrch="all users") returned 0x0 [0053.151] StrStrW (lpFirst="3082", lpSrch="appdata") returned 0x0 [0053.151] GetProcessHeap () returned 0x1130000 [0053.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37f0050 [0053.151] lstrcpyW (in: lpString1=0x37f0050, lpString2="\\\\?\\C:\\588bce7c90097ed212\\3082" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\3082") returned="\\\\?\\C:\\588bce7c90097ed212\\3082" [0053.151] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 29 [0053.151] QueueUserWorkItem (Function=0x129a680, Context=0x37f0050, Flags=0x0) returned 1 [0053.151] GetProcessHeap () returned 0x1130000 [0053.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0053.152] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\*") returned 32 [0053.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b20 [0053.153] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\.") returned 32 [0053.153] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.153] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.153] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.153] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\..") returned 33 [0053.153] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.153] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x2, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.153] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 39 [0053.153] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x2, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.153] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 48 [0053.154] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.154] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 49 [0053.154] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.154] FindClose (in: hFindFile=0x1170b20 | out: hFindFile=0x1170b20) returned 1 [0053.154] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\read_me.txt") returned 42 [0053.154] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.154] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.154] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.155] CloseHandle (hObject=0x3b4) returned 1 [0053.155] GetProcessHeap () returned 0x1130000 [0053.155] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0053.155] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0053.155] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client") returned 32 [0053.155] lstrcmpW (lpString1="Client", lpString2="..") returned 1 [0053.155] lstrcmpW (lpString1="Client", lpString2=".") returned 1 [0053.155] StrStrW (lpFirst="client", lpSrch="programdata") returned 0x0 [0053.155] StrStrW (lpFirst="client", lpSrch="$recycle.bin") returned 0x0 [0053.155] StrStrW (lpFirst="client", lpSrch="program files") returned 0x0 [0053.156] StrStrW (lpFirst="client", lpSrch="windows") returned 0x0 [0053.156] StrStrW (lpFirst="client", lpSrch="all users") returned 0x0 [0053.156] StrStrW (lpFirst="client", lpSrch="appdata") returned 0x0 [0053.156] GetProcessHeap () returned 0x1130000 [0053.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0053.156] lstrcpyW (in: lpString1=0x3810060, lpString2="\\\\?\\C:\\588bce7c90097ed212\\Client" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\Client") returned="\\\\?\\C:\\588bce7c90097ed212\\Client" [0053.156] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 30 [0053.156] QueueUserWorkItem (Function=0x129a680, Context=0x3810060, Flags=0x0) returned 1 [0053.156] GetProcessHeap () returned 0x1130000 [0053.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3820068 [0053.157] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\*") returned 34 [0053.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.161] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\.") returned 34 [0053.161] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.161] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.161] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.161] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\..") returned 35 [0053.161] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.161] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x2, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0053.161] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 50 [0053.161] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x2, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0053.161] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 43 [0053.161] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x2, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0053.161] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.161] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\read_me.txt") returned 44 [0053.161] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\client\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.334] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.334] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.334] CloseHandle (hObject=0x3c0) returned 1 [0053.335] GetProcessHeap () returned 0x1130000 [0053.335] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3820068 | out: hHeap=0x1130000) returned 1 [0053.335] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x2, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0053.335] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 42 [0053.335] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x2, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0053.335] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 41 [0053.335] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0053.335] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended") returned 34 [0053.335] lstrcmpW (lpString1="Extended", lpString2="..") returned 1 [0053.335] lstrcmpW (lpString1="Extended", lpString2=".") returned 1 [0053.335] StrStrW (lpFirst="extended", lpSrch="programdata") returned 0x0 [0053.335] StrStrW (lpFirst="extended", lpSrch="$recycle.bin") returned 0x0 [0053.335] StrStrW (lpFirst="extended", lpSrch="program files") returned 0x0 [0053.336] StrStrW (lpFirst="extended", lpSrch="windows") returned 0x0 [0053.336] StrStrW (lpFirst="extended", lpSrch="all users") returned 0x0 [0053.336] StrStrW (lpFirst="extended", lpSrch="appdata") returned 0x0 [0053.336] GetProcessHeap () returned 0x1130000 [0053.336] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0053.336] lstrcpyW (in: lpString1=0x11bdfa0, lpString2="\\\\?\\C:\\588bce7c90097ed212\\Extended" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\Extended") returned="\\\\?\\C:\\588bce7c90097ed212\\Extended" [0053.336] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 31 [0053.336] QueueUserWorkItem (Function=0x129a680, Context=0x11bdfa0, Flags=0x0) returned 1 [0053.336] GetProcessHeap () returned 0x1130000 [0053.336] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0053.336] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*") returned 36 [0053.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.336] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\.") returned 36 [0053.336] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.336] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.336] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.336] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\..") returned 37 [0053.336] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.336] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x2, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0053.336] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 52 [0053.336] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x2, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0053.336] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 45 [0053.336] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x2, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0053.336] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.337] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\read_me.txt") returned 46 [0053.337] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.337] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.337] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.338] CloseHandle (hObject=0x3c0) returned 1 [0053.339] GetProcessHeap () returned 0x1130000 [0053.339] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0053.339] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0053.339] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics") returned 34 [0053.339] lstrcmpW (lpString1="Graphics", lpString2="..") returned 1 [0053.339] lstrcmpW (lpString1="Graphics", lpString2=".") returned 1 [0053.339] StrStrW (lpFirst="graphics", lpSrch="programdata") returned 0x0 [0053.339] StrStrW (lpFirst="graphics", lpSrch="$recycle.bin") returned 0x0 [0053.339] StrStrW (lpFirst="graphics", lpSrch="program files") returned 0x0 [0053.339] StrStrW (lpFirst="graphics", lpSrch="windows") returned 0x0 [0053.339] StrStrW (lpFirst="graphics", lpSrch="all users") returned 0x0 [0053.339] StrStrW (lpFirst="graphics", lpSrch="appdata") returned 0x0 [0053.339] GetProcessHeap () returned 0x1130000 [0053.339] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0053.339] lstrcpyW (in: lpString1=0x11cdfa8, lpString2="\\\\?\\C:\\588bce7c90097ed212\\Graphics" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\Graphics") returned="\\\\?\\C:\\588bce7c90097ed212\\Graphics" [0053.339] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 32 [0053.339] QueueUserWorkItem (Function=0x129a680, Context=0x11cdfa8, Flags=0x0) returned 1 [0053.339] GetProcessHeap () returned 0x1130000 [0053.339] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3820068 [0053.339] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*") returned 36 [0053.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\.") returned 36 [0053.341] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.341] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\..") returned 37 [0053.341] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 44 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 46 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 46 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 46 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 46 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 46 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 46 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 46 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 46 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x2, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 43 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x2, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 44 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x2, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0053.341] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 43 [0053.341] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x2, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0053.342] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 48 [0053.342] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x2, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0053.342] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 51 [0053.342] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x2, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0053.342] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 43 [0053.342] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x2, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0053.342] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0053.342] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\read_me.txt") returned 46 [0053.342] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.343] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.343] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.344] CloseHandle (hObject=0x3c0) returned 1 [0053.344] GetProcessHeap () returned 0x1130000 [0053.344] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3820068 | out: hHeap=0x1130000) returned 1 [0053.344] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x2, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0053.344] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\header.bmp") returned 36 [0053.344] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x2, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 40 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x2, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 44 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x2, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 44 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x2, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 44 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x2, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 48 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x2, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi.wctc", cAlternateFileName="NE0A0F~1.WCT")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.wctc") returned 53 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x2, dwReserved1=0x0, cFileName="ParameterInfo.xml.wctc", cAlternateFileName="PARAME~1.WCT")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.wctc") returned 48 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x2, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi.wctc", cAlternateFileName="RGB9RA~1.WCT")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.wctc") returned 47 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x2, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi.wctc", cAlternateFileName="RGB9RA~2.WCT")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.wctc") returned 47 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x2, dwReserved1=0x0, cFileName="Setup.exe.wctc", cAlternateFileName="SETUPE~1.WCT")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.wctc") returned 40 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupEngine.dll.wctc", cAlternateFileName="SETUPE~2.WCT")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.wctc") returned 46 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll") returned 37 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd") returned 37 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x2, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe") returned 42 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x2, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 42 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x2, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0053.345] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll") returned 36 [0053.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x2, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0053.346] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml") returned 37 [0053.346] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x2, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0053.346] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml") returned 36 [0053.346] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x2, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0053.346] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp") returned 39 [0053.346] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x2, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0053.346] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 59 [0053.346] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x2, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0053.346] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 59 [0053.346] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x2, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0053.346] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 59 [0053.346] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x2, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0053.346] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 59 [0053.346] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x2, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0053.346] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0053.346] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\read_me.txt") returned 37 [0053.346] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0053.346] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.346] WriteFile (in: hFile=0x3ac, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefbbc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefbbc*=0x9d7, lpOverlapped=0x0) returned 1 [0053.347] CloseHandle (hObject=0x3ac) returned 1 [0053.348] GetProcessHeap () returned 0x1130000 [0053.348] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0053.348] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf47df, dwReserved1=0x7731ac3b, cFileName="Boot", cAlternateFileName="")) returned 1 [0053.348] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot") returned 11 [0053.348] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0053.348] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0053.348] StrStrW (lpFirst="boot", lpSrch="programdata") returned 0x0 [0053.348] StrStrW (lpFirst="boot", lpSrch="$recycle.bin") returned 0x0 [0053.348] StrStrW (lpFirst="boot", lpSrch="program files") returned 0x0 [0053.348] StrStrW (lpFirst="boot", lpSrch="windows") returned 0x0 [0053.348] StrStrW (lpFirst="boot", lpSrch="all users") returned 0x0 [0053.348] StrStrW (lpFirst="boot", lpSrch="appdata") returned 0x0 [0053.348] GetProcessHeap () returned 0x1130000 [0053.348] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0053.348] lstrcpyW (in: lpString1=0x11acf90, lpString2="\\\\?\\C:\\Boot" | out: lpString1="\\\\?\\C:\\Boot") returned="\\\\?\\C:\\Boot" [0053.348] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 33 [0053.348] QueueUserWorkItem (Function=0x129a680, Context=0x11acf90, Flags=0x0) returned 1 [0053.348] GetProcessHeap () returned 0x1130000 [0053.348] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3820068 [0053.348] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\*") returned 13 [0053.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0053.349] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\.") returned 13 [0053.349] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.349] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.349] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.350] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\..") returned 14 [0053.350] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.350] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0053.350] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD") returned 15 [0053.350] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0053.350] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG") returned 19 [0053.350] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0053.350] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG1") returned 20 [0053.350] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0053.350] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG2") returned 20 [0053.350] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0053.350] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG") returned 17 [0053.350] lstrcmpW (lpString1="bg-BG", lpString2="..") returned 1 [0053.350] lstrcmpW (lpString1="bg-BG", lpString2=".") returned 1 [0053.350] StrStrW (lpFirst="bg-bg", lpSrch="programdata") returned 0x0 [0053.350] StrStrW (lpFirst="bg-bg", lpSrch="$recycle.bin") returned 0x0 [0053.350] StrStrW (lpFirst="bg-bg", lpSrch="program files") returned 0x0 [0053.350] StrStrW (lpFirst="bg-bg", lpSrch="windows") returned 0x0 [0053.350] StrStrW (lpFirst="bg-bg", lpSrch="all users") returned 0x0 [0053.350] StrStrW (lpFirst="bg-bg", lpSrch="appdata") returned 0x0 [0053.351] GetProcessHeap () returned 0x1130000 [0053.351] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0053.351] lstrcpyW (in: lpString1=0x3830070, lpString2="\\\\?\\C:\\Boot\\bg-BG" | out: lpString1="\\\\?\\C:\\Boot\\bg-BG") returned="\\\\?\\C:\\Boot\\bg-BG" [0053.351] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 34 [0053.351] QueueUserWorkItem (Function=0x129a680, Context=0x3830070, Flags=0x0) returned 1 [0053.351] GetProcessHeap () returned 0x1130000 [0053.351] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0053.352] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\*") returned 19 [0053.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.352] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\.") returned 19 [0053.352] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.352] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.352] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.352] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\..") returned 20 [0053.352] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.352] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.352] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 33 [0053.352] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.352] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.352] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\read_me.txt") returned 29 [0053.352] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\read_me.txt" (normalized: "c:\\boot\\bg-bg\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.353] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.353] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.354] CloseHandle (hObject=0x3c0) returned 1 [0053.354] GetProcessHeap () returned 0x1130000 [0053.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0053.354] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0053.354] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bootspaces.dll") returned 26 [0053.354] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0053.354] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned 24 [0053.354] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0053.354] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bootvhd.dll") returned 23 [0053.354] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0053.354] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ") returned 17 [0053.354] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0053.354] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0053.354] StrStrW (lpFirst="cs-cz", lpSrch="programdata") returned 0x0 [0053.354] StrStrW (lpFirst="cs-cz", lpSrch="$recycle.bin") returned 0x0 [0053.354] StrStrW (lpFirst="cs-cz", lpSrch="program files") returned 0x0 [0053.354] StrStrW (lpFirst="cs-cz", lpSrch="windows") returned 0x0 [0053.354] StrStrW (lpFirst="cs-cz", lpSrch="all users") returned 0x0 [0053.355] StrStrW (lpFirst="cs-cz", lpSrch="appdata") returned 0x0 [0053.355] GetProcessHeap () returned 0x1130000 [0053.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0053.355] lstrcpyW (in: lpString1=0x3840078, lpString2="\\\\?\\C:\\Boot\\cs-CZ" | out: lpString1="\\\\?\\C:\\Boot\\cs-CZ") returned="\\\\?\\C:\\Boot\\cs-CZ" [0053.355] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 35 [0053.355] QueueUserWorkItem (Function=0x129a680, Context=0x3840078, Flags=0x0) returned 1 [0053.355] GetProcessHeap () returned 0x1130000 [0053.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0053.355] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\*") returned 19 [0053.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.356] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\.") returned 19 [0053.356] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.356] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.356] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.356] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\..") returned 20 [0053.356] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.356] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.356] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 33 [0053.356] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.356] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 33 [0053.356] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.356] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.356] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt") returned 29 [0053.357] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt" (normalized: "c:\\boot\\cs-cz\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.357] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.357] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.358] CloseHandle (hObject=0x3c0) returned 1 [0053.359] GetProcessHeap () returned 0x1130000 [0053.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0053.359] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0053.359] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK") returned 17 [0053.359] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0053.359] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0053.359] StrStrW (lpFirst="da-dk", lpSrch="programdata") returned 0x0 [0053.359] StrStrW (lpFirst="da-dk", lpSrch="$recycle.bin") returned 0x0 [0053.359] StrStrW (lpFirst="da-dk", lpSrch="program files") returned 0x0 [0053.359] StrStrW (lpFirst="da-dk", lpSrch="windows") returned 0x0 [0053.359] StrStrW (lpFirst="da-dk", lpSrch="all users") returned 0x0 [0053.359] StrStrW (lpFirst="da-dk", lpSrch="appdata") returned 0x0 [0053.359] GetProcessHeap () returned 0x1130000 [0053.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3800058 [0053.359] lstrcpyW (in: lpString1=0x3800058, lpString2="\\\\?\\C:\\Boot\\da-DK" | out: lpString1="\\\\?\\C:\\Boot\\da-DK") returned="\\\\?\\C:\\Boot\\da-DK" [0053.359] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 36 [0053.359] QueueUserWorkItem (Function=0x129a680, Context=0x3800058, Flags=0x0) returned 1 [0053.360] GetProcessHeap () returned 0x1130000 [0053.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0053.360] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\*") returned 19 [0053.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.362] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\.") returned 19 [0053.362] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.362] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.362] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.362] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\..") returned 20 [0053.362] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.362] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.362] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 33 [0053.362] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.362] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui") returned 33 [0053.362] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.362] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.362] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\read_me.txt") returned 29 [0053.362] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\read_me.txt" (normalized: "c:\\boot\\da-dk\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.363] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.363] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.364] CloseHandle (hObject=0x3c0) returned 1 [0053.364] GetProcessHeap () returned 0x1130000 [0053.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0053.364] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0053.364] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE") returned 17 [0053.364] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0053.364] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0053.364] StrStrW (lpFirst="de-de", lpSrch="programdata") returned 0x0 [0053.364] StrStrW (lpFirst="de-de", lpSrch="$recycle.bin") returned 0x0 [0053.364] StrStrW (lpFirst="de-de", lpSrch="program files") returned 0x0 [0053.364] StrStrW (lpFirst="de-de", lpSrch="windows") returned 0x0 [0053.364] StrStrW (lpFirst="de-de", lpSrch="all users") returned 0x0 [0053.364] StrStrW (lpFirst="de-de", lpSrch="appdata") returned 0x0 [0053.364] GetProcessHeap () returned 0x1130000 [0053.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0053.364] lstrcpyW (in: lpString1=0x3850080, lpString2="\\\\?\\C:\\Boot\\de-DE" | out: lpString1="\\\\?\\C:\\Boot\\de-DE") returned="\\\\?\\C:\\Boot\\de-DE" [0053.364] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 37 [0053.364] QueueUserWorkItem (Function=0x129a680, Context=0x3850080, Flags=0x0) returned 1 [0053.364] GetProcessHeap () returned 0x1130000 [0053.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3860088 [0053.365] wnsprintfW (in: pszDest=0x3860088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\*") returned 19 [0053.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.365] wnsprintfW (in: pszDest=0x3860088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\.") returned 19 [0053.366] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.366] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.366] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.366] wnsprintfW (in: pszDest=0x3860088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\..") returned 20 [0053.366] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.366] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.366] wnsprintfW (in: pszDest=0x3860088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 33 [0053.366] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.366] wnsprintfW (in: pszDest=0x3860088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui") returned 33 [0053.366] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.366] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.366] wnsprintfW (in: pszDest=0x3860088, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\read_me.txt") returned 29 [0053.366] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\read_me.txt" (normalized: "c:\\boot\\de-de\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.366] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.366] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.367] CloseHandle (hObject=0x3c0) returned 1 [0053.368] GetProcessHeap () returned 0x1130000 [0053.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3860088 | out: hHeap=0x1130000) returned 1 [0053.368] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0053.368] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR") returned 17 [0053.368] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0053.368] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0053.368] StrStrW (lpFirst="el-gr", lpSrch="programdata") returned 0x0 [0053.368] StrStrW (lpFirst="el-gr", lpSrch="$recycle.bin") returned 0x0 [0053.368] StrStrW (lpFirst="el-gr", lpSrch="program files") returned 0x0 [0053.368] StrStrW (lpFirst="el-gr", lpSrch="windows") returned 0x0 [0053.368] StrStrW (lpFirst="el-gr", lpSrch="all users") returned 0x0 [0053.368] StrStrW (lpFirst="el-gr", lpSrch="appdata") returned 0x0 [0053.368] GetProcessHeap () returned 0x1130000 [0053.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3860088 [0053.368] lstrcpyW (in: lpString1=0x3860088, lpString2="\\\\?\\C:\\Boot\\el-GR" | out: lpString1="\\\\?\\C:\\Boot\\el-GR") returned="\\\\?\\C:\\Boot\\el-GR" [0053.368] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 38 [0053.368] QueueUserWorkItem (Function=0x129a680, Context=0x3860088, Flags=0x0) returned 1 [0053.368] GetProcessHeap () returned 0x1130000 [0053.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3870090 [0053.369] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\*") returned 19 [0053.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.622] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\.") returned 19 [0053.622] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.622] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.622] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.622] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\..") returned 20 [0053.622] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.622] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.622] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 33 [0053.622] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.622] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui") returned 33 [0053.622] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.622] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.622] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\read_me.txt") returned 29 [0053.623] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\read_me.txt" (normalized: "c:\\boot\\el-gr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.623] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.623] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.624] CloseHandle (hObject=0x3b4) returned 1 [0053.624] GetProcessHeap () returned 0x1130000 [0053.624] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3870090 | out: hHeap=0x1130000) returned 1 [0053.625] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0053.625] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB") returned 17 [0053.625] lstrcmpW (lpString1="en-GB", lpString2="..") returned 1 [0053.625] lstrcmpW (lpString1="en-GB", lpString2=".") returned 1 [0053.625] StrStrW (lpFirst="en-gb", lpSrch="programdata") returned 0x0 [0053.625] StrStrW (lpFirst="en-gb", lpSrch="$recycle.bin") returned 0x0 [0053.625] StrStrW (lpFirst="en-gb", lpSrch="program files") returned 0x0 [0053.625] StrStrW (lpFirst="en-gb", lpSrch="windows") returned 0x0 [0053.625] StrStrW (lpFirst="en-gb", lpSrch="all users") returned 0x0 [0053.625] StrStrW (lpFirst="en-gb", lpSrch="appdata") returned 0x0 [0053.625] GetProcessHeap () returned 0x1130000 [0053.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.626] lstrcpyW (in: lpString1=0x120dfc8, lpString2="\\\\?\\C:\\Boot\\en-GB" | out: lpString1="\\\\?\\C:\\Boot\\en-GB") returned="\\\\?\\C:\\Boot\\en-GB" [0053.626] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 39 [0053.626] QueueUserWorkItem (Function=0x129a680, Context=0x120dfc8, Flags=0x0) returned 1 [0053.626] GetProcessHeap () returned 0x1130000 [0053.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3870090 [0053.626] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\*") returned 19 [0053.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.627] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\.") returned 19 [0053.627] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.627] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.627] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.627] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\..") returned 20 [0053.627] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.627] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.627] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 33 [0053.627] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.627] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.627] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\read_me.txt") returned 29 [0053.627] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\read_me.txt" (normalized: "c:\\boot\\en-gb\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.628] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.628] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.629] CloseHandle (hObject=0x3b4) returned 1 [0053.629] GetProcessHeap () returned 0x1130000 [0053.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3870090 | out: hHeap=0x1130000) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0053.629] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US") returned 17 [0053.629] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0053.629] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0053.629] StrStrW (lpFirst="en-us", lpSrch="programdata") returned 0x0 [0053.629] StrStrW (lpFirst="en-us", lpSrch="$recycle.bin") returned 0x0 [0053.629] StrStrW (lpFirst="en-us", lpSrch="program files") returned 0x0 [0053.629] StrStrW (lpFirst="en-us", lpSrch="windows") returned 0x0 [0053.629] StrStrW (lpFirst="en-us", lpSrch="all users") returned 0x0 [0053.629] StrStrW (lpFirst="en-us", lpSrch="appdata") returned 0x0 [0053.629] GetProcessHeap () returned 0x1130000 [0053.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3870090 [0053.629] lstrcpyW (in: lpString1=0x3870090, lpString2="\\\\?\\C:\\Boot\\en-US" | out: lpString1="\\\\?\\C:\\Boot\\en-US") returned="\\\\?\\C:\\Boot\\en-US" [0053.629] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 40 [0053.629] QueueUserWorkItem (Function=0x129a680, Context=0x3870090, Flags=0x0) returned 1 [0053.629] GetProcessHeap () returned 0x1130000 [0053.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.630] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\*") returned 19 [0053.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.630] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\.") returned 19 [0053.630] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.630] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.630] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.630] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\..") returned 20 [0053.630] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.630] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.630] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui") returned 33 [0053.630] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.630] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui") returned 33 [0053.630] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.630] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.631] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\read_me.txt") returned 29 [0053.631] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\read_me.txt" (normalized: "c:\\boot\\en-us\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.631] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.631] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.632] CloseHandle (hObject=0x3b4) returned 1 [0053.632] GetProcessHeap () returned 0x1130000 [0053.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.632] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0053.632] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES") returned 17 [0053.632] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0053.632] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0053.632] StrStrW (lpFirst="es-es", lpSrch="programdata") returned 0x0 [0053.632] StrStrW (lpFirst="es-es", lpSrch="$recycle.bin") returned 0x0 [0053.632] StrStrW (lpFirst="es-es", lpSrch="program files") returned 0x0 [0053.632] StrStrW (lpFirst="es-es", lpSrch="windows") returned 0x0 [0053.632] StrStrW (lpFirst="es-es", lpSrch="all users") returned 0x0 [0053.632] StrStrW (lpFirst="es-es", lpSrch="appdata") returned 0x0 [0053.632] GetProcessHeap () returned 0x1130000 [0053.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.632] lstrcpyW (in: lpString1=0x3880098, lpString2="\\\\?\\C:\\Boot\\es-ES" | out: lpString1="\\\\?\\C:\\Boot\\es-ES") returned="\\\\?\\C:\\Boot\\es-ES" [0053.632] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 41 [0053.632] QueueUserWorkItem (Function=0x129a680, Context=0x3880098, Flags=0x0) returned 1 [0053.632] GetProcessHeap () returned 0x1130000 [0053.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0053.633] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\*") returned 19 [0053.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.634] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\.") returned 19 [0053.634] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.634] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.634] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.634] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\..") returned 20 [0053.634] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.634] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.634] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 33 [0053.634] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.634] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui") returned 33 [0053.634] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.634] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.634] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\read_me.txt") returned 29 [0053.635] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\read_me.txt" (normalized: "c:\\boot\\es-es\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.635] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.635] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.635] CloseHandle (hObject=0x3b4) returned 1 [0053.636] GetProcessHeap () returned 0x1130000 [0053.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0053.636] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0053.636] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX") returned 17 [0053.636] lstrcmpW (lpString1="es-MX", lpString2="..") returned 1 [0053.636] lstrcmpW (lpString1="es-MX", lpString2=".") returned 1 [0053.636] StrStrW (lpFirst="es-mx", lpSrch="programdata") returned 0x0 [0053.636] StrStrW (lpFirst="es-mx", lpSrch="$recycle.bin") returned 0x0 [0053.636] StrStrW (lpFirst="es-mx", lpSrch="program files") returned 0x0 [0053.636] StrStrW (lpFirst="es-mx", lpSrch="windows") returned 0x0 [0053.636] StrStrW (lpFirst="es-mx", lpSrch="all users") returned 0x0 [0053.636] StrStrW (lpFirst="es-mx", lpSrch="appdata") returned 0x0 [0053.636] GetProcessHeap () returned 0x1130000 [0053.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0053.636] lstrcpyW (in: lpString1=0x3640078, lpString2="\\\\?\\C:\\Boot\\es-MX" | out: lpString1="\\\\?\\C:\\Boot\\es-MX") returned="\\\\?\\C:\\Boot\\es-MX" [0053.636] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 42 [0053.636] QueueUserWorkItem (Function=0x129a680, Context=0x3640078, Flags=0x0) returned 1 [0053.636] GetProcessHeap () returned 0x1130000 [0053.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3650080 [0053.637] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\*") returned 19 [0053.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.637] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\.") returned 19 [0053.637] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.637] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.637] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.637] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\..") returned 20 [0053.637] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.637] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.637] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 33 [0053.637] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.637] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.638] wnsprintfW (in: pszDest=0x3650080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\read_me.txt") returned 29 [0053.638] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\read_me.txt" (normalized: "c:\\boot\\es-mx\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.638] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.638] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.639] CloseHandle (hObject=0x3b4) returned 1 [0053.639] GetProcessHeap () returned 0x1130000 [0053.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3650080 | out: hHeap=0x1130000) returned 1 [0053.639] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0053.639] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE") returned 17 [0053.639] lstrcmpW (lpString1="et-EE", lpString2="..") returned 1 [0053.639] lstrcmpW (lpString1="et-EE", lpString2=".") returned 1 [0053.639] StrStrW (lpFirst="et-ee", lpSrch="programdata") returned 0x0 [0053.639] StrStrW (lpFirst="et-ee", lpSrch="$recycle.bin") returned 0x0 [0053.639] StrStrW (lpFirst="et-ee", lpSrch="program files") returned 0x0 [0053.639] StrStrW (lpFirst="et-ee", lpSrch="windows") returned 0x0 [0053.639] StrStrW (lpFirst="et-ee", lpSrch="all users") returned 0x0 [0053.639] StrStrW (lpFirst="et-ee", lpSrch="appdata") returned 0x0 [0053.639] GetProcessHeap () returned 0x1130000 [0053.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3650080 [0053.639] lstrcpyW (in: lpString1=0x3650080, lpString2="\\\\?\\C:\\Boot\\et-EE" | out: lpString1="\\\\?\\C:\\Boot\\et-EE") returned="\\\\?\\C:\\Boot\\et-EE" [0053.639] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 43 [0053.639] QueueUserWorkItem (Function=0x129a680, Context=0x3650080, Flags=0x0) returned 1 [0053.639] GetProcessHeap () returned 0x1130000 [0053.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3660088 [0053.640] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\*") returned 19 [0053.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0053.640] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\.") returned 19 [0053.640] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.640] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.640] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.640] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\..") returned 20 [0053.640] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.640] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.640] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 33 [0053.640] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.640] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0053.640] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\read_me.txt") returned 29 [0053.640] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\read_me.txt" (normalized: "c:\\boot\\et-ee\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.641] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.641] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.642] CloseHandle (hObject=0x3b4) returned 1 [0053.642] GetProcessHeap () returned 0x1130000 [0053.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3660088 | out: hHeap=0x1130000) returned 1 [0053.642] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0053.642] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI") returned 17 [0053.642] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0053.642] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0053.642] StrStrW (lpFirst="fi-fi", lpSrch="programdata") returned 0x0 [0053.642] StrStrW (lpFirst="fi-fi", lpSrch="$recycle.bin") returned 0x0 [0053.642] StrStrW (lpFirst="fi-fi", lpSrch="program files") returned 0x0 [0053.642] StrStrW (lpFirst="fi-fi", lpSrch="windows") returned 0x0 [0053.642] StrStrW (lpFirst="fi-fi", lpSrch="all users") returned 0x0 [0053.643] StrStrW (lpFirst="fi-fi", lpSrch="appdata") returned 0x0 [0053.643] GetProcessHeap () returned 0x1130000 [0053.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3660088 [0053.643] lstrcpyW (in: lpString1=0x3660088, lpString2="\\\\?\\C:\\Boot\\fi-FI" | out: lpString1="\\\\?\\C:\\Boot\\fi-FI") returned="\\\\?\\C:\\Boot\\fi-FI" [0053.643] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 44 [0053.643] QueueUserWorkItem (Function=0x129a680, Context=0x3660088, Flags=0x0) returned 1 [0053.643] GetProcessHeap () returned 0x1130000 [0053.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3670090 [0053.643] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\*") returned 19 [0053.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.644] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\.") returned 19 [0053.644] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.644] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.644] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.644] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\..") returned 20 [0053.644] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.644] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.644] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 33 [0053.644] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.644] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui") returned 33 [0053.644] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.644] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.644] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\read_me.txt") returned 29 [0053.644] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\read_me.txt" (normalized: "c:\\boot\\fi-fi\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.644] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.644] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.645] CloseHandle (hObject=0x3b4) returned 1 [0053.646] GetProcessHeap () returned 0x1130000 [0053.646] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3670090 | out: hHeap=0x1130000) returned 1 [0053.646] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0053.646] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts") returned 17 [0053.646] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0053.646] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0053.646] StrStrW (lpFirst="fonts", lpSrch="programdata") returned 0x0 [0053.646] StrStrW (lpFirst="fonts", lpSrch="$recycle.bin") returned 0x0 [0053.646] StrStrW (lpFirst="fonts", lpSrch="program files") returned 0x0 [0053.646] StrStrW (lpFirst="fonts", lpSrch="windows") returned 0x0 [0053.646] StrStrW (lpFirst="fonts", lpSrch="all users") returned 0x0 [0053.646] StrStrW (lpFirst="fonts", lpSrch="appdata") returned 0x0 [0053.646] GetProcessHeap () returned 0x1130000 [0053.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3670090 [0053.646] lstrcpyW (in: lpString1=0x3670090, lpString2="\\\\?\\C:\\Boot\\Fonts" | out: lpString1="\\\\?\\C:\\Boot\\Fonts") returned="\\\\?\\C:\\Boot\\Fonts" [0053.646] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 45 [0053.646] QueueUserWorkItem (Function=0x129a680, Context=0x3670090, Flags=0x0) returned 1 [0053.646] GetProcessHeap () returned 0x1130000 [0053.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.647] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\*") returned 19 [0053.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0053.650] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\.") returned 19 [0053.650] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.650] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.650] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.650] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\..") returned 20 [0053.650] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.650] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x2, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0053.650] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf") returned 30 [0053.650] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x2, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0053.650] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf") returned 30 [0053.650] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x2, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0053.650] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf") returned 30 [0053.650] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x2, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0053.650] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf") returned 30 [0053.650] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x2, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0053.650] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 34 [0053.650] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x2, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0053.650] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf") returned 33 [0053.650] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x2, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 34 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x2, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 33 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x2, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 32 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x2, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf") returned 31 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x2, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 32 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x2, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf") returned 31 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x2, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf") returned 34 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x2, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 35 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x2, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 34 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x2, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0053.651] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 31 [0053.651] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x2, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0053.651] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0053.652] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\read_me.txt") returned 29 [0053.652] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\read_me.txt" (normalized: "c:\\boot\\fonts\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.653] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.653] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.804] CloseHandle (hObject=0x3b4) returned 1 [0053.805] GetProcessHeap () returned 0x1130000 [0053.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0053.805] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA") returned 17 [0053.805] lstrcmpW (lpString1="fr-CA", lpString2="..") returned 1 [0053.805] lstrcmpW (lpString1="fr-CA", lpString2=".") returned 1 [0053.805] StrStrW (lpFirst="fr-ca", lpSrch="programdata") returned 0x0 [0053.805] StrStrW (lpFirst="fr-ca", lpSrch="$recycle.bin") returned 0x0 [0053.805] StrStrW (lpFirst="fr-ca", lpSrch="program files") returned 0x0 [0053.805] StrStrW (lpFirst="fr-ca", lpSrch="windows") returned 0x0 [0053.806] StrStrW (lpFirst="fr-ca", lpSrch="all users") returned 0x0 [0053.806] StrStrW (lpFirst="fr-ca", lpSrch="appdata") returned 0x0 [0053.806] GetProcessHeap () returned 0x1130000 [0053.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.806] lstrcpyW (in: lpString1=0x3680098, lpString2="\\\\?\\C:\\Boot\\fr-CA" | out: lpString1="\\\\?\\C:\\Boot\\fr-CA") returned="\\\\?\\C:\\Boot\\fr-CA" [0053.806] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 46 [0053.806] QueueUserWorkItem (Function=0x129a680, Context=0x3680098, Flags=0x0) returned 1 [0053.806] GetProcessHeap () returned 0x1130000 [0053.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.807] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\*") returned 19 [0053.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0053.808] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\.") returned 19 [0053.808] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.808] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.808] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.808] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\..") returned 20 [0053.808] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.808] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.808] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 33 [0053.808] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.808] FindClose (in: hFindFile=0x1170aa0 | out: hFindFile=0x1170aa0) returned 1 [0053.808] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\read_me.txt") returned 29 [0053.808] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\read_me.txt" (normalized: "c:\\boot\\fr-ca\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.810] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.810] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.811] CloseHandle (hObject=0x3b4) returned 1 [0053.811] GetProcessHeap () returned 0x1130000 [0053.811] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.811] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0053.811] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR") returned 17 [0053.811] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0053.811] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0053.811] StrStrW (lpFirst="fr-fr", lpSrch="programdata") returned 0x0 [0053.812] StrStrW (lpFirst="fr-fr", lpSrch="$recycle.bin") returned 0x0 [0053.812] StrStrW (lpFirst="fr-fr", lpSrch="program files") returned 0x0 [0053.812] StrStrW (lpFirst="fr-fr", lpSrch="windows") returned 0x0 [0053.812] StrStrW (lpFirst="fr-fr", lpSrch="all users") returned 0x0 [0053.812] StrStrW (lpFirst="fr-fr", lpSrch="appdata") returned 0x0 [0053.812] GetProcessHeap () returned 0x1130000 [0053.812] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.812] lstrcpyW (in: lpString1=0x118bf78, lpString2="\\\\?\\C:\\Boot\\fr-FR" | out: lpString1="\\\\?\\C:\\Boot\\fr-FR") returned="\\\\?\\C:\\Boot\\fr-FR" [0053.812] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 47 [0053.812] QueueUserWorkItem (Function=0x129a680, Context=0x118bf78, Flags=0x0) returned 1 [0053.812] GetProcessHeap () returned 0x1130000 [0053.812] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36a00a8 [0053.813] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\*") returned 19 [0053.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0053.813] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\.") returned 19 [0053.813] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.813] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.813] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.813] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\..") returned 20 [0053.813] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.813] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.813] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 33 [0053.813] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.813] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui") returned 33 [0053.813] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.813] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0053.813] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\read_me.txt") returned 29 [0053.813] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\read_me.txt" (normalized: "c:\\boot\\fr-fr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.814] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.814] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.815] CloseHandle (hObject=0x3b4) returned 1 [0053.815] GetProcessHeap () returned 0x1130000 [0053.815] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36a00a8 | out: hHeap=0x1130000) returned 1 [0053.815] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0053.815] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR") returned 17 [0053.815] lstrcmpW (lpString1="hr-HR", lpString2="..") returned 1 [0053.815] lstrcmpW (lpString1="hr-HR", lpString2=".") returned 1 [0053.815] StrStrW (lpFirst="hr-hr", lpSrch="programdata") returned 0x0 [0053.815] StrStrW (lpFirst="hr-hr", lpSrch="$recycle.bin") returned 0x0 [0053.815] StrStrW (lpFirst="hr-hr", lpSrch="program files") returned 0x0 [0053.815] StrStrW (lpFirst="hr-hr", lpSrch="windows") returned 0x0 [0053.815] StrStrW (lpFirst="hr-hr", lpSrch="all users") returned 0x0 [0053.815] StrStrW (lpFirst="hr-hr", lpSrch="appdata") returned 0x0 [0053.815] GetProcessHeap () returned 0x1130000 [0053.815] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36a00a8 [0053.815] lstrcpyW (in: lpString1=0x36a00a8, lpString2="\\\\?\\C:\\Boot\\hr-HR" | out: lpString1="\\\\?\\C:\\Boot\\hr-HR") returned="\\\\?\\C:\\Boot\\hr-HR" [0053.815] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 48 [0053.815] QueueUserWorkItem (Function=0x129a680, Context=0x36a00a8, Flags=0x0) returned 1 [0053.815] GetProcessHeap () returned 0x1130000 [0053.815] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36b00b0 [0053.816] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\*") returned 19 [0053.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.817] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\.") returned 19 [0053.817] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.817] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.817] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.817] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\..") returned 20 [0053.817] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.817] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.817] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 33 [0053.817] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.818] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.818] wnsprintfW (in: pszDest=0x36b00b0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\read_me.txt") returned 29 [0053.818] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\read_me.txt" (normalized: "c:\\boot\\hr-hr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.818] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.818] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.819] CloseHandle (hObject=0x3b4) returned 1 [0053.819] GetProcessHeap () returned 0x1130000 [0053.819] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36b00b0 | out: hHeap=0x1130000) returned 1 [0053.819] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0053.819] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU") returned 17 [0053.819] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0053.819] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0053.819] StrStrW (lpFirst="hu-hu", lpSrch="programdata") returned 0x0 [0053.819] StrStrW (lpFirst="hu-hu", lpSrch="$recycle.bin") returned 0x0 [0053.819] StrStrW (lpFirst="hu-hu", lpSrch="program files") returned 0x0 [0053.819] StrStrW (lpFirst="hu-hu", lpSrch="windows") returned 0x0 [0053.819] StrStrW (lpFirst="hu-hu", lpSrch="all users") returned 0x0 [0053.819] StrStrW (lpFirst="hu-hu", lpSrch="appdata") returned 0x0 [0053.819] GetProcessHeap () returned 0x1130000 [0053.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36b00b0 [0053.819] lstrcpyW (in: lpString1=0x36b00b0, lpString2="\\\\?\\C:\\Boot\\hu-HU" | out: lpString1="\\\\?\\C:\\Boot\\hu-HU") returned="\\\\?\\C:\\Boot\\hu-HU" [0053.819] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 49 [0053.819] QueueUserWorkItem (Function=0x129a680, Context=0x36b00b0, Flags=0x0) returned 1 [0053.819] GetProcessHeap () returned 0x1130000 [0053.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.820] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\*") returned 19 [0053.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.820] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\.") returned 19 [0053.820] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.820] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.820] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.821] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\..") returned 20 [0053.821] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.821] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.821] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 33 [0053.821] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.821] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui") returned 33 [0053.821] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.821] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.821] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\read_me.txt") returned 29 [0053.821] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\read_me.txt" (normalized: "c:\\boot\\hu-hu\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.821] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.821] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.822] CloseHandle (hObject=0x3b4) returned 1 [0053.822] GetProcessHeap () returned 0x1130000 [0053.822] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.822] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0053.822] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT") returned 17 [0053.822] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0053.822] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0053.822] StrStrW (lpFirst="it-it", lpSrch="programdata") returned 0x0 [0053.822] StrStrW (lpFirst="it-it", lpSrch="$recycle.bin") returned 0x0 [0053.822] StrStrW (lpFirst="it-it", lpSrch="program files") returned 0x0 [0053.822] StrStrW (lpFirst="it-it", lpSrch="windows") returned 0x0 [0053.822] StrStrW (lpFirst="it-it", lpSrch="all users") returned 0x0 [0053.823] StrStrW (lpFirst="it-it", lpSrch="appdata") returned 0x0 [0053.823] GetProcessHeap () returned 0x1130000 [0053.823] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.823] lstrcpyW (in: lpString1=0x11ddfb0, lpString2="\\\\?\\C:\\Boot\\it-IT" | out: lpString1="\\\\?\\C:\\Boot\\it-IT") returned="\\\\?\\C:\\Boot\\it-IT" [0053.823] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 50 [0053.823] QueueUserWorkItem (Function=0x129a680, Context=0x11ddfb0, Flags=0x0) returned 1 [0053.823] GetProcessHeap () returned 0x1130000 [0053.823] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11edfb8 [0053.823] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\*") returned 19 [0053.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.824] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\.") returned 19 [0053.824] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.824] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.824] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.824] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\..") returned 20 [0053.824] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.824] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.824] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 33 [0053.824] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.824] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui") returned 33 [0053.824] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.824] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.824] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\read_me.txt") returned 29 [0053.824] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\read_me.txt" (normalized: "c:\\boot\\it-it\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.825] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.825] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.826] CloseHandle (hObject=0x3b4) returned 1 [0053.826] GetProcessHeap () returned 0x1130000 [0053.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11edfb8 | out: hHeap=0x1130000) returned 1 [0053.826] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0053.826] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP") returned 17 [0053.826] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0053.826] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0053.826] StrStrW (lpFirst="ja-jp", lpSrch="programdata") returned 0x0 [0053.826] StrStrW (lpFirst="ja-jp", lpSrch="$recycle.bin") returned 0x0 [0053.826] StrStrW (lpFirst="ja-jp", lpSrch="program files") returned 0x0 [0053.826] StrStrW (lpFirst="ja-jp", lpSrch="windows") returned 0x0 [0053.826] StrStrW (lpFirst="ja-jp", lpSrch="all users") returned 0x0 [0053.826] StrStrW (lpFirst="ja-jp", lpSrch="appdata") returned 0x0 [0053.826] GetProcessHeap () returned 0x1130000 [0053.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11edfb8 [0053.827] lstrcpyW (in: lpString1=0x11edfb8, lpString2="\\\\?\\C:\\Boot\\ja-JP" | out: lpString1="\\\\?\\C:\\Boot\\ja-JP") returned="\\\\?\\C:\\Boot\\ja-JP" [0053.827] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 51 [0053.827] QueueUserWorkItem (Function=0x129a680, Context=0x11edfb8, Flags=0x0) returned 1 [0053.827] GetProcessHeap () returned 0x1130000 [0053.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.827] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\*") returned 19 [0053.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c60 [0053.828] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\.") returned 19 [0053.828] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.828] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.828] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.828] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\..") returned 20 [0053.828] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.828] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.828] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 33 [0053.828] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.828] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui") returned 33 [0053.828] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.828] FindClose (in: hFindFile=0x1170c60 | out: hFindFile=0x1170c60) returned 1 [0053.830] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\read_me.txt") returned 29 [0053.830] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\read_me.txt" (normalized: "c:\\boot\\ja-jp\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.831] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.831] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.831] CloseHandle (hObject=0x3b4) returned 1 [0053.832] GetProcessHeap () returned 0x1130000 [0053.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.832] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0053.832] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR") returned 17 [0053.832] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0053.832] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0053.832] StrStrW (lpFirst="ko-kr", lpSrch="programdata") returned 0x0 [0053.832] StrStrW (lpFirst="ko-kr", lpSrch="$recycle.bin") returned 0x0 [0053.832] StrStrW (lpFirst="ko-kr", lpSrch="program files") returned 0x0 [0053.832] StrStrW (lpFirst="ko-kr", lpSrch="windows") returned 0x0 [0053.832] StrStrW (lpFirst="ko-kr", lpSrch="all users") returned 0x0 [0053.832] StrStrW (lpFirst="ko-kr", lpSrch="appdata") returned 0x0 [0053.832] GetProcessHeap () returned 0x1130000 [0053.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.832] lstrcpyW (in: lpString1=0x35e0048, lpString2="\\\\?\\C:\\Boot\\ko-KR" | out: lpString1="\\\\?\\C:\\Boot\\ko-KR") returned="\\\\?\\C:\\Boot\\ko-KR" [0053.832] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 52 [0053.832] QueueUserWorkItem (Function=0x129a680, Context=0x35e0048, Flags=0x0) returned 1 [0053.832] GetProcessHeap () returned 0x1130000 [0053.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0053.833] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\*") returned 19 [0053.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0053.833] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\.") returned 19 [0053.834] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.834] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.834] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.834] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\..") returned 20 [0053.834] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.834] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.834] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 33 [0053.834] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.834] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui") returned 33 [0053.834] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.834] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0053.834] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\read_me.txt") returned 29 [0053.834] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\read_me.txt" (normalized: "c:\\boot\\ko-kr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.834] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.834] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.835] CloseHandle (hObject=0x3b4) returned 1 [0053.835] GetProcessHeap () returned 0x1130000 [0053.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0053.835] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0053.835] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT") returned 17 [0053.835] lstrcmpW (lpString1="lt-LT", lpString2="..") returned 1 [0053.835] lstrcmpW (lpString1="lt-LT", lpString2=".") returned 1 [0053.835] StrStrW (lpFirst="lt-lt", lpSrch="programdata") returned 0x0 [0053.835] StrStrW (lpFirst="lt-lt", lpSrch="$recycle.bin") returned 0x0 [0053.835] StrStrW (lpFirst="lt-lt", lpSrch="program files") returned 0x0 [0053.835] StrStrW (lpFirst="lt-lt", lpSrch="windows") returned 0x0 [0053.835] StrStrW (lpFirst="lt-lt", lpSrch="all users") returned 0x0 [0053.835] StrStrW (lpFirst="lt-lt", lpSrch="appdata") returned 0x0 [0053.836] GetProcessHeap () returned 0x1130000 [0053.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0053.836] lstrcpyW (in: lpString1=0x35f0050, lpString2="\\\\?\\C:\\Boot\\lt-LT" | out: lpString1="\\\\?\\C:\\Boot\\lt-LT") returned="\\\\?\\C:\\Boot\\lt-LT" [0053.836] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 53 [0053.836] QueueUserWorkItem (Function=0x129a680, Context=0x35f0050, Flags=0x0) returned 1 [0053.836] GetProcessHeap () returned 0x1130000 [0053.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0053.836] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\*") returned 19 [0053.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.836] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\.") returned 19 [0053.836] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.836] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.836] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.836] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\..") returned 20 [0053.836] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.836] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.837] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 33 [0053.837] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.837] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.837] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\read_me.txt") returned 29 [0053.837] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\read_me.txt" (normalized: "c:\\boot\\lt-lt\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.837] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.837] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.838] CloseHandle (hObject=0x3b4) returned 1 [0053.838] GetProcessHeap () returned 0x1130000 [0053.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0053.839] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0053.839] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV") returned 17 [0053.839] lstrcmpW (lpString1="lv-LV", lpString2="..") returned 1 [0053.839] lstrcmpW (lpString1="lv-LV", lpString2=".") returned 1 [0053.839] StrStrW (lpFirst="lv-lv", lpSrch="programdata") returned 0x0 [0053.839] StrStrW (lpFirst="lv-lv", lpSrch="$recycle.bin") returned 0x0 [0053.839] StrStrW (lpFirst="lv-lv", lpSrch="program files") returned 0x0 [0053.839] StrStrW (lpFirst="lv-lv", lpSrch="windows") returned 0x0 [0053.839] StrStrW (lpFirst="lv-lv", lpSrch="all users") returned 0x0 [0053.839] StrStrW (lpFirst="lv-lv", lpSrch="appdata") returned 0x0 [0053.839] GetProcessHeap () returned 0x1130000 [0053.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0053.839] lstrcpyW (in: lpString1=0x3600058, lpString2="\\\\?\\C:\\Boot\\lv-LV" | out: lpString1="\\\\?\\C:\\Boot\\lv-LV") returned="\\\\?\\C:\\Boot\\lv-LV" [0053.839] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 54 [0053.839] QueueUserWorkItem (Function=0x129a680, Context=0x3600058, Flags=0x0) returned 1 [0053.839] GetProcessHeap () returned 0x1130000 [0053.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3610060 [0053.840] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\*") returned 19 [0053.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.840] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\.") returned 19 [0053.840] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0053.840] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.840] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.840] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\..") returned 20 [0053.840] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.840] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.840] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 33 [0053.840] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.841] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.841] wnsprintfW (in: pszDest=0x3610060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\read_me.txt") returned 29 [0053.841] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\read_me.txt" (normalized: "c:\\boot\\lv-lv\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.841] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0053.841] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0053.842] CloseHandle (hObject=0x3b4) returned 1 [0053.842] GetProcessHeap () returned 0x1130000 [0053.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3610060 | out: hHeap=0x1130000) returned 1 [0053.842] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0053.842] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\memtest.exe") returned 23 [0053.842] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0053.842] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO") returned 17 [0053.842] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0053.842] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0053.842] StrStrW (lpFirst="nb-no", lpSrch="programdata") returned 0x0 [0053.842] StrStrW (lpFirst="nb-no", lpSrch="$recycle.bin") returned 0x0 [0053.842] StrStrW (lpFirst="nb-no", lpSrch="program files") returned 0x0 [0053.842] StrStrW (lpFirst="nb-no", lpSrch="windows") returned 0x0 [0053.842] StrStrW (lpFirst="nb-no", lpSrch="all users") returned 0x0 [0053.842] StrStrW (lpFirst="nb-no", lpSrch="appdata") returned 0x0 [0053.842] GetProcessHeap () returned 0x1130000 [0053.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3610060 [0053.842] lstrcpyW (in: lpString1=0x3610060, lpString2="\\\\?\\C:\\Boot\\nb-NO" | out: lpString1="\\\\?\\C:\\Boot\\nb-NO") returned="\\\\?\\C:\\Boot\\nb-NO" [0053.842] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 55 [0053.842] QueueUserWorkItem (Function=0x129a680, Context=0x3610060, Flags=0x0) returned 1 [0053.843] GetProcessHeap () returned 0x1130000 [0053.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3620068 [0054.297] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\*") returned 19 [0054.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.298] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\.") returned 19 [0054.298] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.298] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.298] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.298] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\..") returned 20 [0054.298] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.298] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.298] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 33 [0054.298] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.298] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui") returned 33 [0054.298] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.298] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.298] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\read_me.txt") returned 29 [0054.298] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\read_me.txt" (normalized: "c:\\boot\\nb-no\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.299] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.299] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.300] CloseHandle (hObject=0x3b4) returned 1 [0054.300] GetProcessHeap () returned 0x1130000 [0054.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3620068 | out: hHeap=0x1130000) returned 1 [0054.301] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0054.301] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL") returned 17 [0054.301] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0054.301] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0054.301] StrStrW (lpFirst="nl-nl", lpSrch="programdata") returned 0x0 [0054.301] StrStrW (lpFirst="nl-nl", lpSrch="$recycle.bin") returned 0x0 [0054.301] StrStrW (lpFirst="nl-nl", lpSrch="program files") returned 0x0 [0054.301] StrStrW (lpFirst="nl-nl", lpSrch="windows") returned 0x0 [0054.301] StrStrW (lpFirst="nl-nl", lpSrch="all users") returned 0x0 [0054.301] StrStrW (lpFirst="nl-nl", lpSrch="appdata") returned 0x0 [0054.301] GetProcessHeap () returned 0x1130000 [0054.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0054.302] lstrcpyW (in: lpString1=0x3810060, lpString2="\\\\?\\C:\\Boot\\nl-NL" | out: lpString1="\\\\?\\C:\\Boot\\nl-NL") returned="\\\\?\\C:\\Boot\\nl-NL" [0054.302] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 56 [0054.302] QueueUserWorkItem (Function=0x129a680, Context=0x3810060, Flags=0x0) returned 1 [0054.302] GetProcessHeap () returned 0x1130000 [0054.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0054.303] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\*") returned 19 [0054.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.303] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\.") returned 19 [0054.303] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.303] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.303] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.303] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\..") returned 20 [0054.304] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.304] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.304] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 33 [0054.304] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.304] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui") returned 33 [0054.304] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.304] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.304] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\read_me.txt") returned 29 [0054.304] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\read_me.txt" (normalized: "c:\\boot\\nl-nl\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.304] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.304] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.305] CloseHandle (hObject=0x3b4) returned 1 [0054.305] GetProcessHeap () returned 0x1130000 [0054.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0054.306] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0054.306] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL") returned 17 [0054.306] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0054.306] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0054.306] StrStrW (lpFirst="pl-pl", lpSrch="programdata") returned 0x0 [0054.306] StrStrW (lpFirst="pl-pl", lpSrch="$recycle.bin") returned 0x0 [0054.306] StrStrW (lpFirst="pl-pl", lpSrch="program files") returned 0x0 [0054.306] StrStrW (lpFirst="pl-pl", lpSrch="windows") returned 0x0 [0054.306] StrStrW (lpFirst="pl-pl", lpSrch="all users") returned 0x0 [0054.306] StrStrW (lpFirst="pl-pl", lpSrch="appdata") returned 0x0 [0054.306] GetProcessHeap () returned 0x1130000 [0054.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0054.306] lstrcpyW (in: lpString1=0x11fdfc0, lpString2="\\\\?\\C:\\Boot\\pl-PL" | out: lpString1="\\\\?\\C:\\Boot\\pl-PL") returned="\\\\?\\C:\\Boot\\pl-PL" [0054.306] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 57 [0054.306] QueueUserWorkItem (Function=0x129a680, Context=0x11fdfc0, Flags=0x0) returned 1 [0054.306] GetProcessHeap () returned 0x1130000 [0054.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38900a0 [0054.307] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\*") returned 19 [0054.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.308] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\.") returned 19 [0054.308] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.308] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.308] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.308] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\..") returned 20 [0054.308] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.308] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.308] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 33 [0054.308] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.308] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui") returned 33 [0054.308] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.308] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.308] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\read_me.txt") returned 29 [0054.308] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\read_me.txt" (normalized: "c:\\boot\\pl-pl\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.308] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.308] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.309] CloseHandle (hObject=0x3b4) returned 1 [0054.309] GetProcessHeap () returned 0x1130000 [0054.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0054.309] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR") returned 17 [0054.309] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0054.309] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0054.309] StrStrW (lpFirst="pt-br", lpSrch="programdata") returned 0x0 [0054.309] StrStrW (lpFirst="pt-br", lpSrch="$recycle.bin") returned 0x0 [0054.310] StrStrW (lpFirst="pt-br", lpSrch="program files") returned 0x0 [0054.310] StrStrW (lpFirst="pt-br", lpSrch="windows") returned 0x0 [0054.310] StrStrW (lpFirst="pt-br", lpSrch="all users") returned 0x0 [0054.310] StrStrW (lpFirst="pt-br", lpSrch="appdata") returned 0x0 [0054.310] GetProcessHeap () returned 0x1130000 [0054.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38900a0 [0054.310] lstrcpyW (in: lpString1=0x38900a0, lpString2="\\\\?\\C:\\Boot\\pt-BR" | out: lpString1="\\\\?\\C:\\Boot\\pt-BR") returned="\\\\?\\C:\\Boot\\pt-BR" [0054.310] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 58 [0054.310] QueueUserWorkItem (Function=0x129a680, Context=0x38900a0, Flags=0x0) returned 1 [0054.310] GetProcessHeap () returned 0x1130000 [0054.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3620068 [0054.311] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\*") returned 19 [0054.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.311] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\.") returned 19 [0054.311] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.311] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.312] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.312] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\..") returned 20 [0054.312] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.312] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.312] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 33 [0054.312] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.312] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui") returned 33 [0054.312] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.312] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.312] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\read_me.txt") returned 29 [0054.312] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\read_me.txt" (normalized: "c:\\boot\\pt-br\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.312] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.312] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.313] CloseHandle (hObject=0x3b4) returned 1 [0054.313] GetProcessHeap () returned 0x1130000 [0054.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3620068 | out: hHeap=0x1130000) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0054.313] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT") returned 17 [0054.313] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0054.313] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0054.313] StrStrW (lpFirst="pt-pt", lpSrch="programdata") returned 0x0 [0054.313] StrStrW (lpFirst="pt-pt", lpSrch="$recycle.bin") returned 0x0 [0054.313] StrStrW (lpFirst="pt-pt", lpSrch="program files") returned 0x0 [0054.313] StrStrW (lpFirst="pt-pt", lpSrch="windows") returned 0x0 [0054.313] StrStrW (lpFirst="pt-pt", lpSrch="all users") returned 0x0 [0054.313] StrStrW (lpFirst="pt-pt", lpSrch="appdata") returned 0x0 [0054.313] GetProcessHeap () returned 0x1130000 [0054.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3620068 [0054.314] lstrcpyW (in: lpString1=0x3620068, lpString2="\\\\?\\C:\\Boot\\pt-PT" | out: lpString1="\\\\?\\C:\\Boot\\pt-PT") returned="\\\\?\\C:\\Boot\\pt-PT" [0054.314] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 59 [0054.314] QueueUserWorkItem (Function=0x129a680, Context=0x3620068, Flags=0x0) returned 1 [0054.314] GetProcessHeap () returned 0x1130000 [0054.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0054.314] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\*") returned 19 [0054.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.315] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\.") returned 19 [0054.315] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.315] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.315] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.315] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\..") returned 20 [0054.315] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.315] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.315] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 33 [0054.315] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.315] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui") returned 33 [0054.315] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.315] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.315] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt") returned 29 [0054.315] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt" (normalized: "c:\\boot\\pt-pt\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.316] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.316] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.316] CloseHandle (hObject=0x3b4) returned 1 [0054.317] GetProcessHeap () returned 0x1130000 [0054.317] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0054.317] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0054.317] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc") returned 20 [0054.317] lstrcmpW (lpString1="qps-ploc", lpString2="..") returned 1 [0054.317] lstrcmpW (lpString1="qps-ploc", lpString2=".") returned 1 [0054.317] StrStrW (lpFirst="qps-ploc", lpSrch="programdata") returned 0x0 [0054.317] StrStrW (lpFirst="qps-ploc", lpSrch="$recycle.bin") returned 0x0 [0054.317] StrStrW (lpFirst="qps-ploc", lpSrch="program files") returned 0x0 [0054.317] StrStrW (lpFirst="qps-ploc", lpSrch="windows") returned 0x0 [0054.317] StrStrW (lpFirst="qps-ploc", lpSrch="all users") returned 0x0 [0054.317] StrStrW (lpFirst="qps-ploc", lpSrch="appdata") returned 0x0 [0054.317] GetProcessHeap () returned 0x1130000 [0054.317] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0054.317] lstrcpyW (in: lpString1=0x3630070, lpString2="\\\\?\\C:\\Boot\\qps-ploc" | out: lpString1="\\\\?\\C:\\Boot\\qps-ploc") returned="\\\\?\\C:\\Boot\\qps-ploc" [0054.317] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 60 [0054.317] QueueUserWorkItem (Function=0x129a680, Context=0x3630070, Flags=0x0) returned 1 [0054.317] GetProcessHeap () returned 0x1130000 [0054.317] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37e0048 [0054.318] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\*") returned 22 [0054.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.318] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\.") returned 22 [0054.318] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.318] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.318] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.318] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\..") returned 23 [0054.318] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.318] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.318] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 36 [0054.318] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.318] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 36 [0054.318] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.319] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.319] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\read_me.txt") returned 32 [0054.319] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\read_me.txt" (normalized: "c:\\boot\\qps-ploc\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.319] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.320] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.320] CloseHandle (hObject=0x3b4) returned 1 [0054.320] GetProcessHeap () returned 0x1130000 [0054.320] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37e0048 | out: hHeap=0x1130000) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0054.321] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources") returned 21 [0054.321] lstrcmpW (lpString1="Resources", lpString2="..") returned 1 [0054.321] lstrcmpW (lpString1="Resources", lpString2=".") returned 1 [0054.321] StrStrW (lpFirst="resources", lpSrch="programdata") returned 0x0 [0054.321] StrStrW (lpFirst="resources", lpSrch="$recycle.bin") returned 0x0 [0054.321] StrStrW (lpFirst="resources", lpSrch="program files") returned 0x0 [0054.321] StrStrW (lpFirst="resources", lpSrch="windows") returned 0x0 [0054.321] StrStrW (lpFirst="resources", lpSrch="all users") returned 0x0 [0054.321] StrStrW (lpFirst="resources", lpSrch="appdata") returned 0x0 [0054.321] GetProcessHeap () returned 0x1130000 [0054.321] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37e0048 [0054.321] lstrcpyW (in: lpString1=0x37e0048, lpString2="\\\\?\\C:\\Boot\\Resources" | out: lpString1="\\\\?\\C:\\Boot\\Resources") returned="\\\\?\\C:\\Boot\\Resources" [0054.321] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 61 [0054.321] QueueUserWorkItem (Function=0x129a680, Context=0x37e0048, Flags=0x0) returned 1 [0054.321] GetProcessHeap () returned 0x1130000 [0054.321] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37f0050 [0054.321] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\*") returned 23 [0054.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0054.322] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\.") returned 23 [0054.322] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.322] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.322] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.322] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\..") returned 24 [0054.322] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.322] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0054.322] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\bootres.dll") returned 33 [0054.322] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0054.322] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US") returned 27 [0054.322] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0054.322] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0054.322] StrStrW (lpFirst="en-us", lpSrch="programdata") returned 0x0 [0054.322] StrStrW (lpFirst="en-us", lpSrch="$recycle.bin") returned 0x0 [0054.322] StrStrW (lpFirst="en-us", lpSrch="program files") returned 0x0 [0054.322] StrStrW (lpFirst="en-us", lpSrch="windows") returned 0x0 [0054.323] StrStrW (lpFirst="en-us", lpSrch="all users") returned 0x0 [0054.323] StrStrW (lpFirst="en-us", lpSrch="appdata") returned 0x0 [0054.323] GetProcessHeap () returned 0x1130000 [0054.323] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38a00a8 [0054.323] lstrcpyW (in: lpString1=0x38a00a8, lpString2="\\\\?\\C:\\Boot\\Resources\\en-US" | out: lpString1="\\\\?\\C:\\Boot\\Resources\\en-US") returned="\\\\?\\C:\\Boot\\Resources\\en-US" [0054.323] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 62 [0054.323] QueueUserWorkItem (Function=0x129a680, Context=0x38a00a8, Flags=0x0) returned 1 [0054.323] GetProcessHeap () returned 0x1130000 [0054.323] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38b00b0 [0054.324] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\*") returned 29 [0054.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.324] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\.") returned 29 [0054.324] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.324] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.324] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.324] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\..") returned 30 [0054.324] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.324] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0054.324] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 43 [0054.324] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0054.325] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.325] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\read_me.txt") returned 39 [0054.325] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\read_me.txt" (normalized: "c:\\boot\\resources\\en-us\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.325] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.325] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0054.326] CloseHandle (hObject=0x3c0) returned 1 [0054.326] GetProcessHeap () returned 0x1130000 [0054.326] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38b00b0 | out: hHeap=0x1130000) returned 1 [0054.326] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="en-us", cAlternateFileName="")) returned 0 [0054.326] FindClose (in: hFindFile=0x1170ba0 | out: hFindFile=0x1170ba0) returned 1 [0054.326] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\read_me.txt") returned 33 [0054.326] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\read_me.txt" (normalized: "c:\\boot\\resources\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.326] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.326] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.327] CloseHandle (hObject=0x3b4) returned 1 [0054.328] GetProcessHeap () returned 0x1130000 [0054.328] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37f0050 | out: hHeap=0x1130000) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0054.328] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO") returned 17 [0054.328] lstrcmpW (lpString1="ro-RO", lpString2="..") returned 1 [0054.328] lstrcmpW (lpString1="ro-RO", lpString2=".") returned 1 [0054.328] StrStrW (lpFirst="ro-ro", lpSrch="programdata") returned 0x0 [0054.328] StrStrW (lpFirst="ro-ro", lpSrch="$recycle.bin") returned 0x0 [0054.328] StrStrW (lpFirst="ro-ro", lpSrch="program files") returned 0x0 [0054.328] StrStrW (lpFirst="ro-ro", lpSrch="windows") returned 0x0 [0054.328] StrStrW (lpFirst="ro-ro", lpSrch="all users") returned 0x0 [0054.328] StrStrW (lpFirst="ro-ro", lpSrch="appdata") returned 0x0 [0054.328] GetProcessHeap () returned 0x1130000 [0054.328] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37f0050 [0054.328] lstrcpyW (in: lpString1=0x37f0050, lpString2="\\\\?\\C:\\Boot\\ro-RO" | out: lpString1="\\\\?\\C:\\Boot\\ro-RO") returned="\\\\?\\C:\\Boot\\ro-RO" [0054.328] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 63 [0054.328] QueueUserWorkItem (Function=0x129a680, Context=0x37f0050, Flags=0x0) returned 1 [0054.328] GetProcessHeap () returned 0x1130000 [0054.328] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38b00b0 [0054.328] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\*") returned 19 [0054.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0054.329] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\.") returned 19 [0054.329] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.329] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.329] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.329] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\..") returned 20 [0054.329] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.329] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.329] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 33 [0054.329] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0054.329] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0054.329] wnsprintfW (in: pszDest=0x38b00b0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\read_me.txt") returned 29 [0054.329] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\read_me.txt" (normalized: "c:\\boot\\ro-ro\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.329] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.329] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.330] CloseHandle (hObject=0x3b4) returned 1 [0054.330] GetProcessHeap () returned 0x1130000 [0054.331] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38b00b0 | out: hHeap=0x1130000) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0054.331] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU") returned 17 [0054.331] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0054.331] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0054.331] StrStrW (lpFirst="ru-ru", lpSrch="programdata") returned 0x0 [0054.331] StrStrW (lpFirst="ru-ru", lpSrch="$recycle.bin") returned 0x0 [0054.331] StrStrW (lpFirst="ru-ru", lpSrch="program files") returned 0x0 [0054.331] StrStrW (lpFirst="ru-ru", lpSrch="windows") returned 0x0 [0054.331] StrStrW (lpFirst="ru-ru", lpSrch="all users") returned 0x0 [0054.331] StrStrW (lpFirst="ru-ru", lpSrch="appdata") returned 0x0 [0054.331] GetProcessHeap () returned 0x1130000 [0054.331] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38b00b0 [0054.331] lstrcpyW (in: lpString1=0x38b00b0, lpString2="\\\\?\\C:\\Boot\\ru-RU" | out: lpString1="\\\\?\\C:\\Boot\\ru-RU") returned="\\\\?\\C:\\Boot\\ru-RU" [0054.331] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 64 [0054.331] QueueUserWorkItem (Function=0x129a680, Context=0x38b00b0, Flags=0x0) returned 1 [0054.331] GetProcessHeap () returned 0x1130000 [0054.331] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38c00b8 [0054.332] wnsprintfW (in: pszDest=0x38c00b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\*") returned 19 [0054.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.500] wnsprintfW (in: pszDest=0x38c00b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\.") returned 19 [0054.500] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.500] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.500] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.500] wnsprintfW (in: pszDest=0x38c00b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\..") returned 20 [0054.500] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.500] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.500] wnsprintfW (in: pszDest=0x38c00b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 33 [0054.500] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.500] wnsprintfW (in: pszDest=0x38c00b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui") returned 33 [0054.500] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.500] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.500] wnsprintfW (in: pszDest=0x38c00b8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\read_me.txt") returned 29 [0054.500] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\read_me.txt" (normalized: "c:\\boot\\ru-ru\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.501] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.501] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.502] CloseHandle (hObject=0x3b4) returned 1 [0054.502] GetProcessHeap () returned 0x1130000 [0054.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38c00b8 | out: hHeap=0x1130000) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0054.503] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK") returned 17 [0054.503] lstrcmpW (lpString1="sk-SK", lpString2="..") returned 1 [0054.503] lstrcmpW (lpString1="sk-SK", lpString2=".") returned 1 [0054.503] StrStrW (lpFirst="sk-sk", lpSrch="programdata") returned 0x0 [0054.503] StrStrW (lpFirst="sk-sk", lpSrch="$recycle.bin") returned 0x0 [0054.503] StrStrW (lpFirst="sk-sk", lpSrch="program files") returned 0x0 [0054.503] StrStrW (lpFirst="sk-sk", lpSrch="windows") returned 0x0 [0054.503] StrStrW (lpFirst="sk-sk", lpSrch="all users") returned 0x0 [0054.503] StrStrW (lpFirst="sk-sk", lpSrch="appdata") returned 0x0 [0054.503] GetProcessHeap () returned 0x1130000 [0054.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38c00b8 [0054.503] lstrcpyW (in: lpString1=0x38c00b8, lpString2="\\\\?\\C:\\Boot\\sk-SK" | out: lpString1="\\\\?\\C:\\Boot\\sk-SK") returned="\\\\?\\C:\\Boot\\sk-SK" [0054.503] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 65 [0054.503] QueueUserWorkItem (Function=0x129a680, Context=0x38c00b8, Flags=0x0) returned 1 [0054.503] GetProcessHeap () returned 0x1130000 [0054.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38d00c0 [0054.504] wnsprintfW (in: pszDest=0x38d00c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\*") returned 19 [0054.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.504] wnsprintfW (in: pszDest=0x38d00c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\.") returned 19 [0054.504] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.504] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.504] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.504] wnsprintfW (in: pszDest=0x38d00c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\..") returned 20 [0054.504] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.504] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.504] wnsprintfW (in: pszDest=0x38d00c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 33 [0054.504] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0054.504] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.504] wnsprintfW (in: pszDest=0x38d00c0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\read_me.txt") returned 29 [0054.504] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\read_me.txt" (normalized: "c:\\boot\\sk-sk\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.505] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.505] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.505] CloseHandle (hObject=0x3b4) returned 1 [0054.506] GetProcessHeap () returned 0x1130000 [0054.506] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38d00c0 | out: hHeap=0x1130000) returned 1 [0054.506] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0054.506] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI") returned 17 [0054.506] lstrcmpW (lpString1="sl-SI", lpString2="..") returned 1 [0054.506] lstrcmpW (lpString1="sl-SI", lpString2=".") returned 1 [0054.506] StrStrW (lpFirst="sl-si", lpSrch="programdata") returned 0x0 [0054.506] StrStrW (lpFirst="sl-si", lpSrch="$recycle.bin") returned 0x0 [0054.506] StrStrW (lpFirst="sl-si", lpSrch="program files") returned 0x0 [0054.506] StrStrW (lpFirst="sl-si", lpSrch="windows") returned 0x0 [0054.506] StrStrW (lpFirst="sl-si", lpSrch="all users") returned 0x0 [0054.506] StrStrW (lpFirst="sl-si", lpSrch="appdata") returned 0x0 [0054.506] GetProcessHeap () returned 0x1130000 [0054.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38d00c0 [0054.506] lstrcpyW (in: lpString1=0x38d00c0, lpString2="\\\\?\\C:\\Boot\\sl-SI" | out: lpString1="\\\\?\\C:\\Boot\\sl-SI") returned="\\\\?\\C:\\Boot\\sl-SI" [0054.507] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 66 [0054.507] QueueUserWorkItem (Function=0x129a680, Context=0x38d00c0, Flags=0x0) returned 1 [0054.507] GetProcessHeap () returned 0x1130000 [0054.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38e00c8 [0054.507] wnsprintfW (in: pszDest=0x38e00c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\*") returned 19 [0054.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.508] wnsprintfW (in: pszDest=0x38e00c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\.") returned 19 [0054.508] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.508] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.508] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.508] wnsprintfW (in: pszDest=0x38e00c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\..") returned 20 [0054.508] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.508] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.508] wnsprintfW (in: pszDest=0x38e00c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 33 [0054.508] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0054.508] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.508] wnsprintfW (in: pszDest=0x38e00c8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\read_me.txt") returned 29 [0054.508] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\read_me.txt" (normalized: "c:\\boot\\sl-si\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.508] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.508] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.509] CloseHandle (hObject=0x3b4) returned 1 [0054.509] GetProcessHeap () returned 0x1130000 [0054.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38e00c8 | out: hHeap=0x1130000) returned 1 [0054.509] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0054.509] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS") returned 22 [0054.509] lstrcmpW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0054.510] lstrcmpW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0054.510] StrStrW (lpFirst="sr-latn-cs", lpSrch="programdata") returned 0x0 [0054.510] StrStrW (lpFirst="sr-latn-cs", lpSrch="$recycle.bin") returned 0x0 [0054.510] StrStrW (lpFirst="sr-latn-cs", lpSrch="program files") returned 0x0 [0054.510] StrStrW (lpFirst="sr-latn-cs", lpSrch="windows") returned 0x0 [0054.510] StrStrW (lpFirst="sr-latn-cs", lpSrch="all users") returned 0x0 [0054.510] StrStrW (lpFirst="sr-latn-cs", lpSrch="appdata") returned 0x0 [0054.510] GetProcessHeap () returned 0x1130000 [0054.510] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38e00c8 [0054.510] lstrcpyW (in: lpString1=0x38e00c8, lpString2="\\\\?\\C:\\Boot\\sr-Latn-CS" | out: lpString1="\\\\?\\C:\\Boot\\sr-Latn-CS") returned="\\\\?\\C:\\Boot\\sr-Latn-CS" [0054.510] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 67 [0054.510] QueueUserWorkItem (Function=0x129a680, Context=0x38e00c8, Flags=0x0) returned 1 [0054.510] GetProcessHeap () returned 0x1130000 [0054.510] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38f00d0 [0054.511] wnsprintfW (in: pszDest=0x38f00d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\*") returned 24 [0054.511] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.511] wnsprintfW (in: pszDest=0x38f00d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\.") returned 24 [0054.511] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.511] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.511] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.511] wnsprintfW (in: pszDest=0x38f00d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\..") returned 25 [0054.511] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.511] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.511] wnsprintfW (in: pszDest=0x38f00d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 38 [0054.511] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.511] wnsprintfW (in: pszDest=0x38f00d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 38 [0054.511] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.511] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.511] wnsprintfW (in: pszDest=0x38f00d0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\read_me.txt") returned 34 [0054.511] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\read_me.txt" (normalized: "c:\\boot\\sr-latn-cs\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.512] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.512] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.513] CloseHandle (hObject=0x3b4) returned 1 [0054.513] GetProcessHeap () returned 0x1130000 [0054.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38f00d0 | out: hHeap=0x1130000) returned 1 [0054.513] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0054.513] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS") returned 22 [0054.513] lstrcmpW (lpString1="sr-Latn-RS", lpString2="..") returned 1 [0054.513] lstrcmpW (lpString1="sr-Latn-RS", lpString2=".") returned 1 [0054.513] StrStrW (lpFirst="sr-latn-rs", lpSrch="programdata") returned 0x0 [0054.513] StrStrW (lpFirst="sr-latn-rs", lpSrch="$recycle.bin") returned 0x0 [0054.513] StrStrW (lpFirst="sr-latn-rs", lpSrch="program files") returned 0x0 [0054.513] StrStrW (lpFirst="sr-latn-rs", lpSrch="windows") returned 0x0 [0054.513] StrStrW (lpFirst="sr-latn-rs", lpSrch="all users") returned 0x0 [0054.513] StrStrW (lpFirst="sr-latn-rs", lpSrch="appdata") returned 0x0 [0054.513] GetProcessHeap () returned 0x1130000 [0054.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38f00d0 [0054.513] lstrcpyW (in: lpString1=0x38f00d0, lpString2="\\\\?\\C:\\Boot\\sr-Latn-RS" | out: lpString1="\\\\?\\C:\\Boot\\sr-Latn-RS") returned="\\\\?\\C:\\Boot\\sr-Latn-RS" [0054.513] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 68 [0054.513] QueueUserWorkItem (Function=0x129a680, Context=0x38f00d0, Flags=0x0) returned 1 [0054.513] GetProcessHeap () returned 0x1130000 [0054.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39000d8 [0054.514] wnsprintfW (in: pszDest=0x39000d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\*") returned 24 [0054.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0054.516] wnsprintfW (in: pszDest=0x39000d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\.") returned 24 [0054.516] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.516] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.516] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.516] wnsprintfW (in: pszDest=0x39000d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\..") returned 25 [0054.516] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.516] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.516] wnsprintfW (in: pszDest=0x39000d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 38 [0054.516] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0054.516] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0054.516] wnsprintfW (in: pszDest=0x39000d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\read_me.txt") returned 34 [0054.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\read_me.txt" (normalized: "c:\\boot\\sr-latn-rs\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.517] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.517] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.518] CloseHandle (hObject=0x3b4) returned 1 [0054.518] GetProcessHeap () returned 0x1130000 [0054.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39000d8 | out: hHeap=0x1130000) returned 1 [0054.518] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0054.518] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE") returned 17 [0054.518] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0054.518] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0054.518] StrStrW (lpFirst="sv-se", lpSrch="programdata") returned 0x0 [0054.518] StrStrW (lpFirst="sv-se", lpSrch="$recycle.bin") returned 0x0 [0054.518] StrStrW (lpFirst="sv-se", lpSrch="program files") returned 0x0 [0054.518] StrStrW (lpFirst="sv-se", lpSrch="windows") returned 0x0 [0054.518] StrStrW (lpFirst="sv-se", lpSrch="all users") returned 0x0 [0054.518] StrStrW (lpFirst="sv-se", lpSrch="appdata") returned 0x0 [0054.518] GetProcessHeap () returned 0x1130000 [0054.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39000d8 [0054.518] lstrcpyW (in: lpString1=0x39000d8, lpString2="\\\\?\\C:\\Boot\\sv-SE" | out: lpString1="\\\\?\\C:\\Boot\\sv-SE") returned="\\\\?\\C:\\Boot\\sv-SE" [0054.518] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 69 [0054.518] QueueUserWorkItem (Function=0x129a680, Context=0x39000d8, Flags=0x0) returned 1 [0054.518] GetProcessHeap () returned 0x1130000 [0054.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39100e0 [0054.519] wnsprintfW (in: pszDest=0x39100e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\*") returned 19 [0054.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.520] wnsprintfW (in: pszDest=0x39100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\.") returned 19 [0054.520] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.520] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.520] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.520] wnsprintfW (in: pszDest=0x39100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\..") returned 20 [0054.520] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.520] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.520] wnsprintfW (in: pszDest=0x39100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 33 [0054.520] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.520] wnsprintfW (in: pszDest=0x39100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui") returned 33 [0054.520] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.520] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.520] wnsprintfW (in: pszDest=0x39100e0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt") returned 29 [0054.520] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt" (normalized: "c:\\boot\\sv-se\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.520] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.520] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.521] CloseHandle (hObject=0x3b4) returned 1 [0054.521] GetProcessHeap () returned 0x1130000 [0054.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39100e0 | out: hHeap=0x1130000) returned 1 [0054.521] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0054.521] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR") returned 17 [0054.521] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0054.521] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0054.522] StrStrW (lpFirst="tr-tr", lpSrch="programdata") returned 0x0 [0054.522] StrStrW (lpFirst="tr-tr", lpSrch="$recycle.bin") returned 0x0 [0054.522] StrStrW (lpFirst="tr-tr", lpSrch="program files") returned 0x0 [0054.522] StrStrW (lpFirst="tr-tr", lpSrch="windows") returned 0x0 [0054.522] StrStrW (lpFirst="tr-tr", lpSrch="all users") returned 0x0 [0054.522] StrStrW (lpFirst="tr-tr", lpSrch="appdata") returned 0x0 [0054.522] GetProcessHeap () returned 0x1130000 [0054.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39100e0 [0054.522] lstrcpyW (in: lpString1=0x39100e0, lpString2="\\\\?\\C:\\Boot\\tr-TR" | out: lpString1="\\\\?\\C:\\Boot\\tr-TR") returned="\\\\?\\C:\\Boot\\tr-TR" [0054.522] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 70 [0054.522] QueueUserWorkItem (Function=0x129a680, Context=0x39100e0, Flags=0x0) returned 1 [0054.522] GetProcessHeap () returned 0x1130000 [0054.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39200e8 [0054.522] wnsprintfW (in: pszDest=0x39200e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\*") returned 19 [0054.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.523] wnsprintfW (in: pszDest=0x39200e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\.") returned 19 [0054.523] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.523] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.523] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.523] wnsprintfW (in: pszDest=0x39200e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\..") returned 20 [0054.523] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.523] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.523] wnsprintfW (in: pszDest=0x39200e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 33 [0054.523] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.523] wnsprintfW (in: pszDest=0x39200e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui") returned 33 [0054.523] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.523] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.523] wnsprintfW (in: pszDest=0x39200e8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\read_me.txt") returned 29 [0054.523] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\read_me.txt" (normalized: "c:\\boot\\tr-tr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.523] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.523] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.524] CloseHandle (hObject=0x3b4) returned 1 [0054.524] GetProcessHeap () returned 0x1130000 [0054.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39200e8 | out: hHeap=0x1130000) returned 1 [0054.524] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0054.524] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA") returned 17 [0054.524] lstrcmpW (lpString1="uk-UA", lpString2="..") returned 1 [0054.524] lstrcmpW (lpString1="uk-UA", lpString2=".") returned 1 [0054.524] StrStrW (lpFirst="uk-ua", lpSrch="programdata") returned 0x0 [0054.524] StrStrW (lpFirst="uk-ua", lpSrch="$recycle.bin") returned 0x0 [0054.524] StrStrW (lpFirst="uk-ua", lpSrch="program files") returned 0x0 [0054.524] StrStrW (lpFirst="uk-ua", lpSrch="windows") returned 0x0 [0054.524] StrStrW (lpFirst="uk-ua", lpSrch="all users") returned 0x0 [0054.525] StrStrW (lpFirst="uk-ua", lpSrch="appdata") returned 0x0 [0054.525] GetProcessHeap () returned 0x1130000 [0054.525] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39200e8 [0054.525] lstrcpyW (in: lpString1=0x39200e8, lpString2="\\\\?\\C:\\Boot\\uk-UA" | out: lpString1="\\\\?\\C:\\Boot\\uk-UA") returned="\\\\?\\C:\\Boot\\uk-UA" [0054.525] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 71 [0054.525] QueueUserWorkItem (Function=0x129a680, Context=0x39200e8, Flags=0x0) returned 1 [0054.525] GetProcessHeap () returned 0x1130000 [0054.525] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39300f0 [0054.526] wnsprintfW (in: pszDest=0x39300f0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\*") returned 19 [0054.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0054.526] wnsprintfW (in: pszDest=0x39300f0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\.") returned 19 [0054.526] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.526] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.526] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.527] wnsprintfW (in: pszDest=0x39300f0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\..") returned 20 [0054.527] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.527] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.527] wnsprintfW (in: pszDest=0x39300f0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 33 [0054.527] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0054.527] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0054.527] wnsprintfW (in: pszDest=0x39300f0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\read_me.txt") returned 29 [0054.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\read_me.txt" (normalized: "c:\\boot\\uk-ua\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.527] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.527] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.528] CloseHandle (hObject=0x3b4) returned 1 [0054.528] GetProcessHeap () returned 0x1130000 [0054.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39300f0 | out: hHeap=0x1130000) returned 1 [0054.528] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x2, dwReserved1=0x0, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0054.528] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b") returned 36 [0054.528] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0054.528] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN") returned 17 [0054.528] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0054.528] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0054.528] StrStrW (lpFirst="zh-cn", lpSrch="programdata") returned 0x0 [0054.528] StrStrW (lpFirst="zh-cn", lpSrch="$recycle.bin") returned 0x0 [0054.528] StrStrW (lpFirst="zh-cn", lpSrch="program files") returned 0x0 [0054.528] StrStrW (lpFirst="zh-cn", lpSrch="windows") returned 0x0 [0054.528] StrStrW (lpFirst="zh-cn", lpSrch="all users") returned 0x0 [0054.528] StrStrW (lpFirst="zh-cn", lpSrch="appdata") returned 0x0 [0054.528] GetProcessHeap () returned 0x1130000 [0054.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39300f0 [0054.528] lstrcpyW (in: lpString1=0x39300f0, lpString2="\\\\?\\C:\\Boot\\zh-CN" | out: lpString1="\\\\?\\C:\\Boot\\zh-CN") returned="\\\\?\\C:\\Boot\\zh-CN" [0054.528] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 72 [0054.529] QueueUserWorkItem (Function=0x129a680, Context=0x39300f0, Flags=0x0) returned 1 [0054.529] GetProcessHeap () returned 0x1130000 [0054.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39400f8 [0054.529] wnsprintfW (in: pszDest=0x39400f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\*") returned 19 [0054.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.530] wnsprintfW (in: pszDest=0x39400f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\.") returned 19 [0054.530] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.530] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.530] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.532] wnsprintfW (in: pszDest=0x39400f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\..") returned 20 [0054.532] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.532] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.533] wnsprintfW (in: pszDest=0x39400f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 33 [0054.533] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.533] wnsprintfW (in: pszDest=0x39400f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui") returned 33 [0054.533] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.533] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.533] wnsprintfW (in: pszDest=0x39400f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt") returned 29 [0054.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt" (normalized: "c:\\boot\\zh-cn\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.533] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.533] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.534] CloseHandle (hObject=0x3b4) returned 1 [0054.534] GetProcessHeap () returned 0x1130000 [0054.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39400f8 | out: hHeap=0x1130000) returned 1 [0054.534] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0054.535] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK") returned 17 [0054.535] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0054.535] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0054.535] StrStrW (lpFirst="zh-hk", lpSrch="programdata") returned 0x0 [0054.535] StrStrW (lpFirst="zh-hk", lpSrch="$recycle.bin") returned 0x0 [0054.535] StrStrW (lpFirst="zh-hk", lpSrch="program files") returned 0x0 [0054.535] StrStrW (lpFirst="zh-hk", lpSrch="windows") returned 0x0 [0054.535] StrStrW (lpFirst="zh-hk", lpSrch="all users") returned 0x0 [0054.535] StrStrW (lpFirst="zh-hk", lpSrch="appdata") returned 0x0 [0054.535] GetProcessHeap () returned 0x1130000 [0054.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39400f8 [0054.535] lstrcpyW (in: lpString1=0x39400f8, lpString2="\\\\?\\C:\\Boot\\zh-HK" | out: lpString1="\\\\?\\C:\\Boot\\zh-HK") returned="\\\\?\\C:\\Boot\\zh-HK" [0054.535] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 73 [0054.535] QueueUserWorkItem (Function=0x129a680, Context=0x39400f8, Flags=0x0) returned 1 [0054.535] GetProcessHeap () returned 0x1130000 [0054.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3950100 [0054.536] wnsprintfW (in: pszDest=0x3950100, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\*") returned 19 [0054.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.536] wnsprintfW (in: pszDest=0x3950100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\.") returned 19 [0054.536] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.536] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.536] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.536] wnsprintfW (in: pszDest=0x3950100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\..") returned 20 [0054.536] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.536] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.536] wnsprintfW (in: pszDest=0x3950100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 33 [0054.536] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.536] wnsprintfW (in: pszDest=0x3950100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui") returned 33 [0054.536] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.536] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.536] wnsprintfW (in: pszDest=0x3950100, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\read_me.txt") returned 29 [0054.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\read_me.txt" (normalized: "c:\\boot\\zh-hk\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0054.536] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.536] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.537] CloseHandle (hObject=0x3b4) returned 1 [0054.537] GetProcessHeap () returned 0x1130000 [0054.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3950100 | out: hHeap=0x1130000) returned 1 [0054.537] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0054.537] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW") returned 17 [0054.538] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0054.538] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0054.538] StrStrW (lpFirst="zh-tw", lpSrch="programdata") returned 0x0 [0054.538] StrStrW (lpFirst="zh-tw", lpSrch="$recycle.bin") returned 0x0 [0054.538] StrStrW (lpFirst="zh-tw", lpSrch="program files") returned 0x0 [0054.538] StrStrW (lpFirst="zh-tw", lpSrch="windows") returned 0x0 [0054.538] StrStrW (lpFirst="zh-tw", lpSrch="all users") returned 0x0 [0054.538] StrStrW (lpFirst="zh-tw", lpSrch="appdata") returned 0x0 [0054.538] GetProcessHeap () returned 0x1130000 [0054.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3950100 [0054.538] lstrcpyW (in: lpString1=0x3950100, lpString2="\\\\?\\C:\\Boot\\zh-TW" | out: lpString1="\\\\?\\C:\\Boot\\zh-TW") returned="\\\\?\\C:\\Boot\\zh-TW" [0054.538] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 74 [0054.538] QueueUserWorkItem (Function=0x129a680, Context=0x3950100, Flags=0x0) returned 1 [0054.538] GetProcessHeap () returned 0x1130000 [0054.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3960108 [0054.539] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\*") returned 19 [0054.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0054.669] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\.") returned 19 [0054.669] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0054.670] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.670] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.670] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\..") returned 20 [0054.670] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.670] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x2, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.670] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 33 [0054.670] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0054.670] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui") returned 33 [0054.670] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x2, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0054.670] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0054.670] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt") returned 29 [0054.670] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt" (normalized: "c:\\boot\\zh-tw\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.820] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0054.820] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0054.823] CloseHandle (hObject=0x3c0) returned 1 [0054.823] GetProcessHeap () returned 0x1130000 [0054.823] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3960108 | out: hHeap=0x1130000) returned 1 [0054.823] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0054.824] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0055.084] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\read_me.txt") returned 23 [0055.084] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\read_me.txt" (normalized: "c:\\boot\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0055.170] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.171] WriteFile (in: hFile=0x3ac, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefbbc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefbbc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.172] CloseHandle (hObject=0x3ac) returned 1 [0055.172] GetProcessHeap () returned 0x1130000 [0055.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3820068 | out: hHeap=0x1130000) returned 1 [0055.174] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bf47df, dwReserved1=0x7731ac3b, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0055.174] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\bootmgr") returned 14 [0055.174] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x77bf47df, dwReserved1=0x7731ac3b, cFileName="BOOTNXT.wctc", cAlternateFileName="BOOTNX~1.WCT")) returned 1 [0055.174] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\BOOTNXT.wctc") returned 19 [0055.174] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x77bf47df, dwReserved1=0x7731ac3b, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0055.174] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\BOOTSECT.BAK") returned 19 [0055.174] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0055.174] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Documents and Settings") returned 29 [0055.174] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0055.174] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0055.174] StrStrW (lpFirst="documents and settings", lpSrch="programdata") returned 0x0 [0055.174] StrStrW (lpFirst="documents and settings", lpSrch="$recycle.bin") returned 0x0 [0055.174] StrStrW (lpFirst="documents and settings", lpSrch="program files") returned 0x0 [0055.174] StrStrW (lpFirst="documents and settings", lpSrch="windows") returned 0x0 [0055.174] StrStrW (lpFirst="documents and settings", lpSrch="all users") returned 0x0 [0055.174] StrStrW (lpFirst="documents and settings", lpSrch="appdata") returned 0x0 [0055.175] GetProcessHeap () returned 0x1130000 [0055.175] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0055.175] lstrcpyW (in: lpString1=0x11acf90, lpString2="\\\\?\\C:\\Documents and Settings" | out: lpString1="\\\\?\\C:\\Documents and Settings") returned="\\\\?\\C:\\Documents and Settings" [0055.175] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 75 [0055.175] QueueUserWorkItem (Function=0x129a680, Context=0x11acf90, Flags=0x0) returned 1 [0055.175] GetProcessHeap () returned 0x1130000 [0055.175] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3800058 [0055.176] wnsprintfW (in: pszDest=0x3800058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Documents and Settings\\*") returned 31 [0055.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.177] wnsprintfW (in: pszDest=0x3800058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Documents and Settings\\read_me.txt") returned 41 [0055.177] CreateFileW (lpFileName="\\\\?\\C:\\Documents and Settings\\read_me.txt" (normalized: "c:\\documents and settings\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0055.178] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.178] WriteFile (in: hFile=0x3ac, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefbbc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefbbc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.179] CloseHandle (hObject=0x3ac) returned 1 [0055.179] GetProcessHeap () returned 0x1130000 [0055.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3800058 | out: hHeap=0x1130000) returned 1 [0055.179] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="ESD", cAlternateFileName="")) returned 1 [0055.179] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ESD") returned 10 [0055.179] lstrcmpW (lpString1="ESD", lpString2="..") returned 1 [0055.179] lstrcmpW (lpString1="ESD", lpString2=".") returned 1 [0055.179] StrStrW (lpFirst="esd", lpSrch="programdata") returned 0x0 [0055.179] StrStrW (lpFirst="esd", lpSrch="$recycle.bin") returned 0x0 [0055.179] StrStrW (lpFirst="esd", lpSrch="program files") returned 0x0 [0055.179] StrStrW (lpFirst="esd", lpSrch="windows") returned 0x0 [0055.180] StrStrW (lpFirst="esd", lpSrch="all users") returned 0x0 [0055.180] StrStrW (lpFirst="esd", lpSrch="appdata") returned 0x0 [0055.180] GetProcessHeap () returned 0x1130000 [0055.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3800058 [0055.180] lstrcpyW (in: lpString1=0x3800058, lpString2="\\\\?\\C:\\ESD" | out: lpString1="\\\\?\\C:\\ESD") returned="\\\\?\\C:\\ESD" [0055.180] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 76 [0055.180] QueueUserWorkItem (Function=0x129a680, Context=0x3800058, Flags=0x0) returned 1 [0055.180] GetProcessHeap () returned 0x1130000 [0055.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3820068 [0055.180] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ESD\\*") returned 12 [0055.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0055.184] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ESD\\.") returned 12 [0055.184] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.184] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.184] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.184] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ESD\\..") returned 13 [0055.184] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.184] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.184] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0055.184] wnsprintfW (in: pszDest=0x3820068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\ESD\\read_me.txt") returned 22 [0055.184] CreateFileW (lpFileName="\\\\?\\C:\\ESD\\read_me.txt" (normalized: "c:\\esd\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0055.184] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.184] WriteFile (in: hFile=0x3ac, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefbbc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefbbc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.185] CloseHandle (hObject=0x3ac) returned 1 [0055.185] GetProcessHeap () returned 0x1130000 [0055.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3820068 | out: hHeap=0x1130000) returned 1 [0055.185] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0055.185] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\hiberfil.sys") returned 19 [0055.185] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="Logs", cAlternateFileName="")) returned 1 [0055.185] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs") returned 11 [0055.185] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0055.185] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0055.185] StrStrW (lpFirst="logs", lpSrch="programdata") returned 0x0 [0055.185] StrStrW (lpFirst="logs", lpSrch="$recycle.bin") returned 0x0 [0055.185] StrStrW (lpFirst="logs", lpSrch="program files") returned 0x0 [0055.186] StrStrW (lpFirst="logs", lpSrch="windows") returned 0x0 [0055.186] StrStrW (lpFirst="logs", lpSrch="all users") returned 0x0 [0055.186] StrStrW (lpFirst="logs", lpSrch="appdata") returned 0x0 [0055.186] GetProcessHeap () returned 0x1130000 [0055.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3820068 [0055.186] lstrcpyW (in: lpString1=0x3820068, lpString2="\\\\?\\C:\\Logs" | out: lpString1="\\\\?\\C:\\Logs") returned="\\\\?\\C:\\Logs" [0055.186] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 77 [0055.186] QueueUserWorkItem (Function=0x129a680, Context=0x3820068, Flags=0x0) returned 1 [0055.186] GetProcessHeap () returned 0x1130000 [0055.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0055.186] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Logs\\*") returned 13 [0055.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0055.190] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\.") returned 13 [0055.190] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.190] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.190] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\..") returned 14 [0055.194] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Application.evtx") returned 28 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\HardwareEvents.evtx") returned 31 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Internet Explorer.evtx") returned 34 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Key Management Service.evtx") returned 39 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 59 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 90 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 83 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 57 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 60 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 69 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 68 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 58 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0055.194] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 54 [0055.194] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 60 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 62 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 68 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 67 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 61 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 76 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 59 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 61 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 75 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 61 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 60 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 90 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0055.195] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 60 [0055.195] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 66 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 53 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 55 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 61 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 71 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 59 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 59 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 63 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 61 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 59 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 61 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 60 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 68 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0055.196] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 65 [0055.196] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 63 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 54 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 59 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 60 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 54 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 45 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 51 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 52 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 62 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 52 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 44 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 86 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 58 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 76 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 53 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 59 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 59 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0055.197] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 58 [0055.197] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 58 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 57 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 54 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 51 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 58 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 57 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 54 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 53 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 61 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 78 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 84 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 82 [0055.198] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0055.198] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 88 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 54 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 68 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 56 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 57 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 69 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 54 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 64 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 56 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 94 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 84 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 69 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 56 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 60 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Security.evtx") returned 25 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Setup.evtx") returned 22 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x2, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0055.199] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\System.evtx") returned 23 [0055.199] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0055.200] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Windows PowerShell.evtx") returned 35 [0055.200] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0055.200] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0055.200] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Logs\\read_me.txt") returned 23 [0055.200] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\read_me.txt" (normalized: "c:\\logs\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0055.201] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.201] WriteFile (in: hFile=0x3ac, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefbbc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefbbc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.202] CloseHandle (hObject=0x3ac) returned 1 [0055.203] GetProcessHeap () returned 0x1130000 [0055.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0055.203] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0055.203] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\pagefile.sys") returned 19 [0055.203] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0055.203] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs") returned 15 [0055.203] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0055.203] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0055.203] StrStrW (lpFirst="perflogs", lpSrch="programdata") returned 0x0 [0055.204] StrStrW (lpFirst="perflogs", lpSrch="$recycle.bin") returned 0x0 [0055.204] StrStrW (lpFirst="perflogs", lpSrch="program files") returned 0x0 [0055.204] StrStrW (lpFirst="perflogs", lpSrch="windows") returned 0x0 [0055.204] StrStrW (lpFirst="perflogs", lpSrch="all users") returned 0x0 [0055.204] StrStrW (lpFirst="perflogs", lpSrch="appdata") returned 0x0 [0055.204] GetProcessHeap () returned 0x1130000 [0055.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0055.204] lstrcpyW (in: lpString1=0x3830070, lpString2="\\\\?\\C:\\PerfLogs" | out: lpString1="\\\\?\\C:\\PerfLogs") returned="\\\\?\\C:\\PerfLogs" [0055.204] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 78 [0055.204] QueueUserWorkItem (Function=0x129a680, Context=0x3830070, Flags=0x0) returned 1 [0055.204] GetProcessHeap () returned 0x1130000 [0055.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0055.204] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\PerfLogs\\*") returned 17 [0055.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0055.205] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\.") returned 17 [0055.205] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.205] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.205] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.205] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\..") returned 18 [0055.205] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.205] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.205] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0055.205] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\PerfLogs\\read_me.txt") returned 27 [0055.205] CreateFileW (lpFileName="\\\\?\\C:\\PerfLogs\\read_me.txt" (normalized: "c:\\perflogs\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0055.207] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.207] WriteFile (in: hFile=0x3ac, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefbbc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefbbc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.208] CloseHandle (hObject=0x3ac) returned 1 [0055.208] GetProcessHeap () returned 0x1130000 [0055.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd9876ae2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xd9876ae2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0055.208] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Program Files") returned 20 [0055.208] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0055.208] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0055.208] StrStrW (lpFirst="program files", lpSrch="programdata") returned 0x0 [0055.208] StrStrW (lpFirst="program files", lpSrch="$recycle.bin") returned 0x0 [0055.208] StrStrW (lpFirst="program files", lpSrch="program files") returned="program files" [0055.208] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0055.208] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Program Files (x86)") returned 26 [0055.208] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0055.208] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0055.208] StrStrW (lpFirst="program files (x86)", lpSrch="programdata") returned 0x0 [0055.208] StrStrW (lpFirst="program files (x86)", lpSrch="$recycle.bin") returned 0x0 [0055.208] StrStrW (lpFirst="program files (x86)", lpSrch="program files") returned="program files (x86)" [0055.208] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0055.208] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData") returned 18 [0055.208] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0055.208] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0055.208] StrStrW (lpFirst="programdata", lpSrch="programdata") returned="programdata" [0055.208] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="Recovery", cAlternateFileName="")) returned 1 [0055.208] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery") returned 15 [0055.208] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0055.208] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0055.208] StrStrW (lpFirst="recovery", lpSrch="programdata") returned 0x0 [0055.208] StrStrW (lpFirst="recovery", lpSrch="$recycle.bin") returned 0x0 [0055.209] StrStrW (lpFirst="recovery", lpSrch="program files") returned 0x0 [0055.209] StrStrW (lpFirst="recovery", lpSrch="windows") returned 0x0 [0055.209] StrStrW (lpFirst="recovery", lpSrch="all users") returned 0x0 [0055.209] StrStrW (lpFirst="recovery", lpSrch="appdata") returned 0x0 [0055.209] GetProcessHeap () returned 0x1130000 [0055.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0055.209] lstrcpyW (in: lpString1=0x3850080, lpString2="\\\\?\\C:\\Recovery" | out: lpString1="\\\\?\\C:\\Recovery") returned="\\\\?\\C:\\Recovery" [0055.209] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 79 [0055.209] QueueUserWorkItem (Function=0x129a680, Context=0x3850080, Flags=0x0) returned 1 [0055.209] GetProcessHeap () returned 0x1130000 [0055.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdc28 [0055.210] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Recovery\\*") returned 17 [0055.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.218] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\.") returned 17 [0055.218] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.224] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.225] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.225] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\..") returned 18 [0055.225] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.225] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0055.225] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\Logs") returned 20 [0055.225] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0055.225] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0055.225] StrStrW (lpFirst="logs", lpSrch="programdata") returned 0x0 [0055.225] StrStrW (lpFirst="logs", lpSrch="$recycle.bin") returned 0x0 [0055.225] StrStrW (lpFirst="logs", lpSrch="program files") returned 0x0 [0055.225] StrStrW (lpFirst="logs", lpSrch="windows") returned 0x0 [0055.225] StrStrW (lpFirst="logs", lpSrch="all users") returned 0x0 [0055.225] StrStrW (lpFirst="logs", lpSrch="appdata") returned 0x0 [0055.225] GetProcessHeap () returned 0x1130000 [0055.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdc30 [0055.225] lstrcpyW (in: lpString1=0x11cdc30, lpString2="\\\\?\\C:\\Recovery\\Logs" | out: lpString1="\\\\?\\C:\\Recovery\\Logs") returned="\\\\?\\C:\\Recovery\\Logs" [0055.225] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 80 [0055.225] QueueUserWorkItem (Function=0x129a680, Context=0x11cdc30, Flags=0x0) returned 1 [0055.225] GetProcessHeap () returned 0x1130000 [0055.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3960108 [0055.226] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Recovery\\Logs\\*") returned 22 [0055.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\Logs\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0055.227] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\Logs\\.") returned 22 [0055.227] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.227] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.227] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.227] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\Logs\\..") returned 23 [0055.227] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.227] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.227] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0055.227] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Recovery\\Logs\\read_me.txt") returned 32 [0055.227] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\Logs\\read_me.txt" (normalized: "c:\\recovery\\logs\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0055.228] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.228] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0055.229] CloseHandle (hObject=0x3c0) returned 1 [0055.229] GetProcessHeap () returned 0x1130000 [0055.229] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3960108 | out: hHeap=0x1130000) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x2, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 1 [0055.229] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\ReAgentOld.xml") returned 30 [0055.229] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x2, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 0 [0055.229] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0055.229] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Recovery\\read_me.txt") returned 27 [0055.229] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\read_me.txt" (normalized: "c:\\recovery\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0055.229] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.229] WriteFile (in: hFile=0x3ac, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefbbc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefbbc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.230] CloseHandle (hObject=0x3ac) returned 1 [0055.230] GetProcessHeap () returned 0x1130000 [0055.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0055.230] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0055.230] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\swapfile.sys") returned 19 [0055.230] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0055.230] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\System Volume Information") returned 32 [0055.230] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0055.230] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0055.230] StrStrW (lpFirst="system volume information", lpSrch="programdata") returned 0x0 [0055.230] StrStrW (lpFirst="system volume information", lpSrch="$recycle.bin") returned 0x0 [0055.230] StrStrW (lpFirst="system volume information", lpSrch="program files") returned 0x0 [0055.230] StrStrW (lpFirst="system volume information", lpSrch="windows") returned 0x0 [0055.230] StrStrW (lpFirst="system volume information", lpSrch="all users") returned 0x0 [0055.230] StrStrW (lpFirst="system volume information", lpSrch="appdata") returned 0x0 [0055.231] GetProcessHeap () returned 0x1130000 [0055.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdc28 [0055.231] lstrcpyW (in: lpString1=0x11bdc28, lpString2="\\\\?\\C:\\System Volume Information" | out: lpString1="\\\\?\\C:\\System Volume Information") returned="\\\\?\\C:\\System Volume Information" [0055.231] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 81 [0055.231] QueueUserWorkItem (Function=0x129a680, Context=0x11bdc28, Flags=0x0) returned 1 [0055.231] GetProcessHeap () returned 0x1130000 [0055.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3960108 [0055.231] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\System Volume Information\\*") returned 34 [0055.231] FindFirstFileW (in: lpFileName="\\\\?\\C:\\System Volume Information\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.231] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\System Volume Information\\read_me.txt") returned 44 [0055.231] CreateFileW (lpFileName="\\\\?\\C:\\System Volume Information\\read_me.txt" (normalized: "c:\\system volume information\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.231] GetProcessHeap () returned 0x1130000 [0055.231] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3960108 | out: hHeap=0x1130000) returned 1 [0055.231] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0xeefbd0 | out: lpFindFileData=0xeefbd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7731ac3b, cFileName="Users", cAlternateFileName="")) returned 1 [0055.231] wnsprintfW (in: pszDest=0x119bf80, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users") returned 12 [0055.231] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0055.231] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0055.231] StrStrW (lpFirst="users", lpSrch="programdata") returned 0x0 [0055.231] StrStrW (lpFirst="users", lpSrch="$recycle.bin") returned 0x0 [0055.231] StrStrW (lpFirst="users", lpSrch="program files") returned 0x0 [0055.231] StrStrW (lpFirst="users", lpSrch="windows") returned 0x0 [0055.231] StrStrW (lpFirst="users", lpSrch="all users") returned 0x0 [0055.231] StrStrW (lpFirst="users", lpSrch="appdata") returned 0x0 [0055.231] GetProcessHeap () returned 0x1130000 [0055.231] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3960108 [0055.231] lstrcpyW (in: lpString1=0x3960108, lpString2="\\\\?\\C:\\Users" | out: lpString1="\\\\?\\C:\\Users") returned="\\\\?\\C:\\Users" [0055.231] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 82 [0055.232] QueueUserWorkItem (Function=0x129a680, Context=0x3960108, Flags=0x0) returned 1 [0055.232] GetProcessHeap () returned 0x1130000 [0055.232] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0055.232] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\*") returned 14 [0055.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf2a1793c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0055.232] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\.") returned 14 [0055.232] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.232] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.232] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf2a1793c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.232] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\..") returned 15 [0055.232] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.232] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0055.232] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\All Users") returned 22 [0055.232] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0055.232] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0055.233] StrStrW (lpFirst="all users", lpSrch="programdata") returned 0x0 [0055.233] StrStrW (lpFirst="all users", lpSrch="$recycle.bin") returned 0x0 [0055.233] StrStrW (lpFirst="all users", lpSrch="program files") returned 0x0 [0055.233] StrStrW (lpFirst="all users", lpSrch="windows") returned 0x0 [0055.233] StrStrW (lpFirst="all users", lpSrch="all users") returned="all users" [0055.233] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0055.233] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default") returned 20 [0055.233] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0055.233] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0055.233] StrStrW (lpFirst="default", lpSrch="programdata") returned 0x0 [0055.233] StrStrW (lpFirst="default", lpSrch="$recycle.bin") returned 0x0 [0055.233] StrStrW (lpFirst="default", lpSrch="program files") returned 0x0 [0055.233] StrStrW (lpFirst="default", lpSrch="windows") returned 0x0 [0055.233] StrStrW (lpFirst="default", lpSrch="all users") returned 0x0 [0055.233] StrStrW (lpFirst="default", lpSrch="appdata") returned 0x0 [0055.233] GetProcessHeap () returned 0x1130000 [0055.233] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3980118 [0055.234] lstrcpyW (in: lpString1=0x3980118, lpString2="\\\\?\\C:\\Users\\Default" | out: lpString1="\\\\?\\C:\\Users\\Default") returned="\\\\?\\C:\\Users\\Default" [0055.234] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 83 [0055.234] QueueUserWorkItem (Function=0x129a680, Context=0x3980118, Flags=0x0) returned 1 [0055.234] GetProcessHeap () returned 0x1130000 [0055.234] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3990120 [0055.235] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\*") returned 22 [0055.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0055.235] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\.") returned 22 [0055.235] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.235] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.235] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.236] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\..") returned 23 [0055.236] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.236] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0055.236] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData") returned 28 [0055.236] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0055.236] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0055.236] StrStrW (lpFirst="appdata", lpSrch="programdata") returned 0x0 [0055.236] StrStrW (lpFirst="appdata", lpSrch="$recycle.bin") returned 0x0 [0055.236] StrStrW (lpFirst="appdata", lpSrch="program files") returned 0x0 [0055.236] StrStrW (lpFirst="appdata", lpSrch="windows") returned 0x0 [0055.236] StrStrW (lpFirst="appdata", lpSrch="all users") returned 0x0 [0055.236] StrStrW (lpFirst="appdata", lpSrch="appdata") returned="appdata" [0055.236] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0055.236] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data") returned 37 [0055.236] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0055.236] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0055.236] StrStrW (lpFirst="application data", lpSrch="programdata") returned 0x0 [0055.236] StrStrW (lpFirst="application data", lpSrch="$recycle.bin") returned 0x0 [0055.236] StrStrW (lpFirst="application data", lpSrch="program files") returned 0x0 [0055.236] StrStrW (lpFirst="application data", lpSrch="windows") returned 0x0 [0055.236] StrStrW (lpFirst="application data", lpSrch="all users") returned 0x0 [0055.236] StrStrW (lpFirst="application data", lpSrch="appdata") returned 0x0 [0055.236] GetProcessHeap () returned 0x1130000 [0055.236] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39a0128 [0055.237] lstrcpyW (in: lpString1=0x39a0128, lpString2="\\\\?\\C:\\Users\\Default\\Application Data" | out: lpString1="\\\\?\\C:\\Users\\Default\\Application Data") returned="\\\\?\\C:\\Users\\Default\\Application Data" [0055.237] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 84 [0055.237] QueueUserWorkItem (Function=0x129a680, Context=0x39a0128, Flags=0x0) returned 1 [0055.237] GetProcessHeap () returned 0x1130000 [0055.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39b0130 [0055.238] wnsprintfW (in: pszDest=0x39b0130, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data\\*") returned 39 [0055.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Application Data\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.238] wnsprintfW (in: pszDest=0x39b0130, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data\\read_me.txt") returned 49 [0055.238] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Application Data\\read_me.txt" (normalized: "c:\\users\\default\\application data\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.239] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.239] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.240] CloseHandle (hObject=0x3b8) returned 1 [0055.240] GetProcessHeap () returned 0x1130000 [0055.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39b0130 | out: hHeap=0x1130000) returned 1 [0055.240] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0055.240] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies") returned 28 [0055.240] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0055.241] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0055.241] StrStrW (lpFirst="cookies", lpSrch="programdata") returned 0x0 [0055.241] StrStrW (lpFirst="cookies", lpSrch="$recycle.bin") returned 0x0 [0055.241] StrStrW (lpFirst="cookies", lpSrch="program files") returned 0x0 [0055.241] StrStrW (lpFirst="cookies", lpSrch="windows") returned 0x0 [0055.241] StrStrW (lpFirst="cookies", lpSrch="all users") returned 0x0 [0055.241] StrStrW (lpFirst="cookies", lpSrch="appdata") returned 0x0 [0055.241] GetProcessHeap () returned 0x1130000 [0055.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39b0130 [0055.241] lstrcpyW (in: lpString1=0x39b0130, lpString2="\\\\?\\C:\\Users\\Default\\Cookies" | out: lpString1="\\\\?\\C:\\Users\\Default\\Cookies") returned="\\\\?\\C:\\Users\\Default\\Cookies" [0055.241] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 85 [0055.241] QueueUserWorkItem (Function=0x129a680, Context=0x39b0130, Flags=0x0) returned 1 [0055.241] GetProcessHeap () returned 0x1130000 [0055.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39c0138 [0055.242] wnsprintfW (in: pszDest=0x39c0138, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies\\*") returned 30 [0055.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Cookies\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.242] wnsprintfW (in: pszDest=0x39c0138, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies\\read_me.txt") returned 40 [0055.242] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Cookies\\read_me.txt" (normalized: "c:\\users\\default\\cookies\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.246] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.246] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.247] CloseHandle (hObject=0x3b8) returned 1 [0055.247] GetProcessHeap () returned 0x1130000 [0055.247] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39c0138 | out: hHeap=0x1130000) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0055.247] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop") returned 28 [0055.247] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0055.247] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0055.247] StrStrW (lpFirst="desktop", lpSrch="programdata") returned 0x0 [0055.247] StrStrW (lpFirst="desktop", lpSrch="$recycle.bin") returned 0x0 [0055.247] StrStrW (lpFirst="desktop", lpSrch="program files") returned 0x0 [0055.247] StrStrW (lpFirst="desktop", lpSrch="windows") returned 0x0 [0055.247] StrStrW (lpFirst="desktop", lpSrch="all users") returned 0x0 [0055.247] StrStrW (lpFirst="desktop", lpSrch="appdata") returned 0x0 [0055.247] GetProcessHeap () returned 0x1130000 [0055.248] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39c0138 [0055.248] lstrcpyW (in: lpString1=0x39c0138, lpString2="\\\\?\\C:\\Users\\Default\\Desktop" | out: lpString1="\\\\?\\C:\\Users\\Default\\Desktop") returned="\\\\?\\C:\\Users\\Default\\Desktop" [0055.248] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 86 [0055.248] QueueUserWorkItem (Function=0x129a680, Context=0x39c0138, Flags=0x0) returned 1 [0055.248] GetProcessHeap () returned 0x1130000 [0055.248] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3be0048 [0055.249] wnsprintfW (in: pszDest=0x3be0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\*") returned 30 [0055.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.250] wnsprintfW (in: pszDest=0x3be0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\.") returned 30 [0055.250] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.250] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.250] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.250] wnsprintfW (in: pszDest=0x3be0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\..") returned 31 [0055.250] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.250] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.250] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.250] wnsprintfW (in: pszDest=0x3be0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\read_me.txt") returned 40 [0055.250] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\read_me.txt" (normalized: "c:\\users\\default\\desktop\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.250] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.250] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.251] CloseHandle (hObject=0x3b8) returned 1 [0055.251] GetProcessHeap () returned 0x1130000 [0055.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3be0048 | out: hHeap=0x1130000) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0055.251] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents") returned 30 [0055.251] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0055.251] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0055.251] StrStrW (lpFirst="documents", lpSrch="programdata") returned 0x0 [0055.252] StrStrW (lpFirst="documents", lpSrch="$recycle.bin") returned 0x0 [0055.252] StrStrW (lpFirst="documents", lpSrch="program files") returned 0x0 [0055.252] StrStrW (lpFirst="documents", lpSrch="windows") returned 0x0 [0055.252] StrStrW (lpFirst="documents", lpSrch="all users") returned 0x0 [0055.252] StrStrW (lpFirst="documents", lpSrch="appdata") returned 0x0 [0055.252] GetProcessHeap () returned 0x1130000 [0055.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3be0048 [0055.252] lstrcpyW (in: lpString1=0x3be0048, lpString2="\\\\?\\C:\\Users\\Default\\Documents" | out: lpString1="\\\\?\\C:\\Users\\Default\\Documents") returned="\\\\?\\C:\\Users\\Default\\Documents" [0055.252] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 87 [0055.252] QueueUserWorkItem (Function=0x129a680, Context=0x3be0048, Flags=0x0) returned 1 [0055.252] GetProcessHeap () returned 0x1130000 [0055.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3bf0050 [0055.253] wnsprintfW (in: pszDest=0x3bf0050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\*") returned 32 [0055.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0055.254] wnsprintfW (in: pszDest=0x3bf0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\.") returned 32 [0055.254] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.254] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.254] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.254] wnsprintfW (in: pszDest=0x3bf0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\..") returned 33 [0055.254] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.254] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0055.254] wnsprintfW (in: pszDest=0x3bf0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music") returned 39 [0055.254] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0055.254] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0055.254] StrStrW (lpFirst="my music", lpSrch="programdata") returned 0x0 [0055.254] StrStrW (lpFirst="my music", lpSrch="$recycle.bin") returned 0x0 [0055.254] StrStrW (lpFirst="my music", lpSrch="program files") returned 0x0 [0055.254] StrStrW (lpFirst="my music", lpSrch="windows") returned 0x0 [0055.255] StrStrW (lpFirst="my music", lpSrch="all users") returned 0x0 [0055.255] StrStrW (lpFirst="my music", lpSrch="appdata") returned 0x0 [0055.255] GetProcessHeap () returned 0x1130000 [0055.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c00058 [0055.256] lstrcpyW (in: lpString1=0x3c00058, lpString2="\\\\?\\C:\\Users\\Default\\Documents\\My Music" | out: lpString1="\\\\?\\C:\\Users\\Default\\Documents\\My Music") returned="\\\\?\\C:\\Users\\Default\\Documents\\My Music" [0055.256] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 88 [0055.256] QueueUserWorkItem (Function=0x129a680, Context=0x3c00058, Flags=0x0) returned 1 [0055.256] GetProcessHeap () returned 0x1130000 [0055.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c10060 [0055.256] wnsprintfW (in: pszDest=0x3c10060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\*") returned 41 [0055.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.257] wnsprintfW (in: pszDest=0x3c10060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\read_me.txt") returned 51 [0055.257] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\read_me.txt" (normalized: "c:\\users\\default\\documents\\my music\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0055.331] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.331] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.332] CloseHandle (hObject=0x3b4) returned 1 [0055.332] GetProcessHeap () returned 0x1130000 [0055.332] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c10060 | out: hHeap=0x1130000) returned 1 [0055.332] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0055.332] wnsprintfW (in: pszDest=0x3bf0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures") returned 42 [0055.332] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0055.332] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0055.332] StrStrW (lpFirst="my pictures", lpSrch="programdata") returned 0x0 [0055.332] StrStrW (lpFirst="my pictures", lpSrch="$recycle.bin") returned 0x0 [0055.332] StrStrW (lpFirst="my pictures", lpSrch="program files") returned 0x0 [0055.332] StrStrW (lpFirst="my pictures", lpSrch="windows") returned 0x0 [0055.332] StrStrW (lpFirst="my pictures", lpSrch="all users") returned 0x0 [0055.332] StrStrW (lpFirst="my pictures", lpSrch="appdata") returned 0x0 [0055.332] GetProcessHeap () returned 0x1130000 [0055.332] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3860088 [0055.332] lstrcpyW (in: lpString1=0x3860088, lpString2="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures") returned="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures" [0055.333] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 89 [0055.333] QueueUserWorkItem (Function=0x129a680, Context=0x3860088, Flags=0x0) returned 1 [0055.333] GetProcessHeap () returned 0x1130000 [0055.333] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0055.333] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\*") returned 44 [0055.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.333] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\read_me.txt") returned 54 [0055.333] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\read_me.txt" (normalized: "c:\\users\\default\\documents\\my pictures\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0055.335] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.335] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.336] CloseHandle (hObject=0x3b4) returned 1 [0055.336] GetProcessHeap () returned 0x1130000 [0055.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0055.336] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0055.336] wnsprintfW (in: pszDest=0x3bf0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos") returned 40 [0055.336] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0055.336] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0055.336] StrStrW (lpFirst="my videos", lpSrch="programdata") returned 0x0 [0055.336] StrStrW (lpFirst="my videos", lpSrch="$recycle.bin") returned 0x0 [0055.336] StrStrW (lpFirst="my videos", lpSrch="program files") returned 0x0 [0055.336] StrStrW (lpFirst="my videos", lpSrch="windows") returned 0x0 [0055.336] StrStrW (lpFirst="my videos", lpSrch="all users") returned 0x0 [0055.336] StrStrW (lpFirst="my videos", lpSrch="appdata") returned 0x0 [0055.337] GetProcessHeap () returned 0x1130000 [0055.337] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0055.337] lstrcpyW (in: lpString1=0x3840078, lpString2="\\\\?\\C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="\\\\?\\C:\\Users\\Default\\Documents\\My Videos") returned="\\\\?\\C:\\Users\\Default\\Documents\\My Videos" [0055.337] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 90 [0055.337] QueueUserWorkItem (Function=0x129a680, Context=0x3840078, Flags=0x0) returned 1 [0055.337] GetProcessHeap () returned 0x1130000 [0055.337] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c10060 [0055.337] wnsprintfW (in: pszDest=0x3c10060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\*") returned 42 [0055.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.337] wnsprintfW (in: pszDest=0x3c10060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\read_me.txt") returned 52 [0055.337] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\read_me.txt" (normalized: "c:\\users\\default\\documents\\my videos\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0055.337] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.337] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.338] CloseHandle (hObject=0x3b4) returned 1 [0055.338] GetProcessHeap () returned 0x1130000 [0055.338] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c10060 | out: hHeap=0x1130000) returned 1 [0055.338] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="my videos", cAlternateFileName="MYVIDE~1")) returned 0 [0055.338] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0055.339] wnsprintfW (in: pszDest=0x3bf0050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\read_me.txt") returned 42 [0055.339] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\read_me.txt" (normalized: "c:\\users\\default\\documents\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.340] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.340] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.340] CloseHandle (hObject=0x3b8) returned 1 [0055.341] GetProcessHeap () returned 0x1130000 [0055.341] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3bf0050 | out: hHeap=0x1130000) returned 1 [0055.341] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0055.341] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads") returned 30 [0055.341] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0055.341] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0055.341] StrStrW (lpFirst="downloads", lpSrch="programdata") returned 0x0 [0055.341] StrStrW (lpFirst="downloads", lpSrch="$recycle.bin") returned 0x0 [0055.341] StrStrW (lpFirst="downloads", lpSrch="program files") returned 0x0 [0055.341] StrStrW (lpFirst="downloads", lpSrch="windows") returned 0x0 [0055.341] StrStrW (lpFirst="downloads", lpSrch="all users") returned 0x0 [0055.341] StrStrW (lpFirst="downloads", lpSrch="appdata") returned 0x0 [0055.341] GetProcessHeap () returned 0x1130000 [0055.341] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3bf0050 [0055.341] lstrcpyW (in: lpString1=0x3bf0050, lpString2="\\\\?\\C:\\Users\\Default\\Downloads" | out: lpString1="\\\\?\\C:\\Users\\Default\\Downloads") returned="\\\\?\\C:\\Users\\Default\\Downloads" [0055.341] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 91 [0055.341] QueueUserWorkItem (Function=0x129a680, Context=0x3bf0050, Flags=0x0) returned 1 [0055.341] GetProcessHeap () returned 0x1130000 [0055.341] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c10060 [0055.341] wnsprintfW (in: pszDest=0x3c10060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\*") returned 32 [0055.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.341] wnsprintfW (in: pszDest=0x3c10060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\.") returned 32 [0055.341] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.341] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.341] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.342] wnsprintfW (in: pszDest=0x3c10060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\..") returned 33 [0055.342] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.342] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.342] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.342] wnsprintfW (in: pszDest=0x3c10060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\read_me.txt") returned 42 [0055.342] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\read_me.txt" (normalized: "c:\\users\\default\\downloads\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.343] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.343] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.344] CloseHandle (hObject=0x3b8) returned 1 [0055.344] GetProcessHeap () returned 0x1130000 [0055.344] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c10060 | out: hHeap=0x1130000) returned 1 [0055.344] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0055.344] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites") returned 30 [0055.344] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0055.344] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0055.344] StrStrW (lpFirst="favorites", lpSrch="programdata") returned 0x0 [0055.344] StrStrW (lpFirst="favorites", lpSrch="$recycle.bin") returned 0x0 [0055.345] StrStrW (lpFirst="favorites", lpSrch="program files") returned 0x0 [0055.345] StrStrW (lpFirst="favorites", lpSrch="windows") returned 0x0 [0055.345] StrStrW (lpFirst="favorites", lpSrch="all users") returned 0x0 [0055.345] StrStrW (lpFirst="favorites", lpSrch="appdata") returned 0x0 [0055.345] GetProcessHeap () returned 0x1130000 [0055.345] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c10060 [0055.345] lstrcpyW (in: lpString1=0x3c10060, lpString2="\\\\?\\C:\\Users\\Default\\Favorites" | out: lpString1="\\\\?\\C:\\Users\\Default\\Favorites") returned="\\\\?\\C:\\Users\\Default\\Favorites" [0055.345] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 92 [0055.345] QueueUserWorkItem (Function=0x129a680, Context=0x3c10060, Flags=0x0) returned 1 [0055.345] GetProcessHeap () returned 0x1130000 [0055.345] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c20068 [0055.346] wnsprintfW (in: pszDest=0x3c20068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\*") returned 32 [0055.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.347] wnsprintfW (in: pszDest=0x3c20068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\.") returned 32 [0055.347] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.347] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.347] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.347] wnsprintfW (in: pszDest=0x3c20068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\..") returned 33 [0055.347] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.347] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.347] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.347] wnsprintfW (in: pszDest=0x3c20068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\read_me.txt") returned 42 [0055.347] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\read_me.txt" (normalized: "c:\\users\\default\\favorites\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.347] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.347] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.348] CloseHandle (hObject=0x3b8) returned 1 [0055.348] GetProcessHeap () returned 0x1130000 [0055.348] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c20068 | out: hHeap=0x1130000) returned 1 [0055.348] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0055.348] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links") returned 26 [0055.349] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0055.349] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0055.349] StrStrW (lpFirst="links", lpSrch="programdata") returned 0x0 [0055.349] StrStrW (lpFirst="links", lpSrch="$recycle.bin") returned 0x0 [0055.349] StrStrW (lpFirst="links", lpSrch="program files") returned 0x0 [0055.349] StrStrW (lpFirst="links", lpSrch="windows") returned 0x0 [0055.349] StrStrW (lpFirst="links", lpSrch="all users") returned 0x0 [0055.349] StrStrW (lpFirst="links", lpSrch="appdata") returned 0x0 [0055.349] GetProcessHeap () returned 0x1130000 [0055.349] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c20068 [0055.349] lstrcpyW (in: lpString1=0x3c20068, lpString2="\\\\?\\C:\\Users\\Default\\Links" | out: lpString1="\\\\?\\C:\\Users\\Default\\Links") returned="\\\\?\\C:\\Users\\Default\\Links" [0055.349] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 93 [0055.349] QueueUserWorkItem (Function=0x129a680, Context=0x3c20068, Flags=0x0) returned 1 [0055.349] GetProcessHeap () returned 0x1130000 [0055.349] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c30070 [0055.350] wnsprintfW (in: pszDest=0x3c30070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\*") returned 28 [0055.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Links\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.350] wnsprintfW (in: pszDest=0x3c30070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\.") returned 28 [0055.350] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.350] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.350] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.350] wnsprintfW (in: pszDest=0x3c30070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\..") returned 29 [0055.350] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.350] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.350] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.350] wnsprintfW (in: pszDest=0x3c30070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\read_me.txt") returned 38 [0055.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\read_me.txt" (normalized: "c:\\users\\default\\links\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.351] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.351] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.351] CloseHandle (hObject=0x3b8) returned 1 [0055.351] GetProcessHeap () returned 0x1130000 [0055.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c30070 | out: hHeap=0x1130000) returned 1 [0055.352] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0055.352] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings") returned 35 [0055.352] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0055.352] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0055.352] StrStrW (lpFirst="local settings", lpSrch="programdata") returned 0x0 [0055.352] StrStrW (lpFirst="local settings", lpSrch="$recycle.bin") returned 0x0 [0055.352] StrStrW (lpFirst="local settings", lpSrch="program files") returned 0x0 [0055.352] StrStrW (lpFirst="local settings", lpSrch="windows") returned 0x0 [0055.352] StrStrW (lpFirst="local settings", lpSrch="all users") returned 0x0 [0055.352] StrStrW (lpFirst="local settings", lpSrch="appdata") returned 0x0 [0055.352] GetProcessHeap () returned 0x1130000 [0055.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c30070 [0055.352] lstrcpyW (in: lpString1=0x3c30070, lpString2="\\\\?\\C:\\Users\\Default\\Local Settings" | out: lpString1="\\\\?\\C:\\Users\\Default\\Local Settings") returned="\\\\?\\C:\\Users\\Default\\Local Settings" [0055.352] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 94 [0055.352] QueueUserWorkItem (Function=0x129a680, Context=0x3c30070, Flags=0x0) returned 1 [0055.352] GetProcessHeap () returned 0x1130000 [0055.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c40078 [0055.353] wnsprintfW (in: pszDest=0x3c40078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings\\*") returned 37 [0055.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.353] wnsprintfW (in: pszDest=0x3c40078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings\\read_me.txt") returned 47 [0055.353] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Local Settings\\read_me.txt" (normalized: "c:\\users\\default\\local settings\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.353] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.353] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.354] CloseHandle (hObject=0x3b8) returned 1 [0055.354] GetProcessHeap () returned 0x1130000 [0055.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c40078 | out: hHeap=0x1130000) returned 1 [0055.354] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0055.355] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music") returned 26 [0055.355] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0055.355] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0055.355] StrStrW (lpFirst="music", lpSrch="programdata") returned 0x0 [0055.355] StrStrW (lpFirst="music", lpSrch="$recycle.bin") returned 0x0 [0055.355] StrStrW (lpFirst="music", lpSrch="program files") returned 0x0 [0055.355] StrStrW (lpFirst="music", lpSrch="windows") returned 0x0 [0055.355] StrStrW (lpFirst="music", lpSrch="all users") returned 0x0 [0055.355] StrStrW (lpFirst="music", lpSrch="appdata") returned 0x0 [0055.355] GetProcessHeap () returned 0x1130000 [0055.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c40078 [0055.355] lstrcpyW (in: lpString1=0x3c40078, lpString2="\\\\?\\C:\\Users\\Default\\Music" | out: lpString1="\\\\?\\C:\\Users\\Default\\Music") returned="\\\\?\\C:\\Users\\Default\\Music" [0055.355] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 95 [0055.355] QueueUserWorkItem (Function=0x129a680, Context=0x3c40078, Flags=0x0) returned 1 [0055.355] GetProcessHeap () returned 0x1130000 [0055.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c50080 [0055.356] wnsprintfW (in: pszDest=0x3c50080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\*") returned 28 [0055.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Music\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2b48e6e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.356] wnsprintfW (in: pszDest=0x3c50080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\.") returned 28 [0055.356] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.356] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.356] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2b48e6e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.356] wnsprintfW (in: pszDest=0x3c50080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\..") returned 29 [0055.356] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.356] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b48e6e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.356] wnsprintfW (in: pszDest=0x3c50080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\read_me.txt") returned 38 [0055.356] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b48e6e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.356] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.356] wnsprintfW (in: pszDest=0x3c50080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\read_me.txt") returned 38 [0055.356] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Music\\read_me.txt" (normalized: "c:\\users\\default\\music\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.357] GetProcessHeap () returned 0x1130000 [0055.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c50080 | out: hHeap=0x1130000) returned 1 [0055.357] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0055.357] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents") returned 33 [0055.357] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0055.357] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0055.357] StrStrW (lpFirst="my documents", lpSrch="programdata") returned 0x0 [0055.357] StrStrW (lpFirst="my documents", lpSrch="$recycle.bin") returned 0x0 [0055.357] StrStrW (lpFirst="my documents", lpSrch="program files") returned 0x0 [0055.357] StrStrW (lpFirst="my documents", lpSrch="windows") returned 0x0 [0055.357] StrStrW (lpFirst="my documents", lpSrch="all users") returned 0x0 [0055.357] StrStrW (lpFirst="my documents", lpSrch="appdata") returned 0x0 [0055.357] GetProcessHeap () returned 0x1130000 [0055.357] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c50080 [0055.357] lstrcpyW (in: lpString1=0x3c50080, lpString2="\\\\?\\C:\\Users\\Default\\My Documents" | out: lpString1="\\\\?\\C:\\Users\\Default\\My Documents") returned="\\\\?\\C:\\Users\\Default\\My Documents" [0055.357] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 96 [0055.357] QueueUserWorkItem (Function=0x129a680, Context=0x3c50080, Flags=0x0) returned 1 [0055.357] GetProcessHeap () returned 0x1130000 [0055.357] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c60088 [0055.358] wnsprintfW (in: pszDest=0x3c60088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents\\*") returned 35 [0055.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\My Documents\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b48e6e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.358] wnsprintfW (in: pszDest=0x3c60088, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents\\read_me.txt") returned 45 [0055.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\My Documents\\read_me.txt" (normalized: "c:\\users\\default\\my documents\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.358] GetProcessHeap () returned 0x1130000 [0055.358] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c60088 | out: hHeap=0x1130000) returned 1 [0055.358] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0055.359] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood") returned 28 [0055.359] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0055.359] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0055.359] StrStrW (lpFirst="nethood", lpSrch="programdata") returned 0x0 [0055.359] StrStrW (lpFirst="nethood", lpSrch="$recycle.bin") returned 0x0 [0055.359] StrStrW (lpFirst="nethood", lpSrch="program files") returned 0x0 [0055.359] StrStrW (lpFirst="nethood", lpSrch="windows") returned 0x0 [0055.359] StrStrW (lpFirst="nethood", lpSrch="all users") returned 0x0 [0055.359] StrStrW (lpFirst="nethood", lpSrch="appdata") returned 0x0 [0055.359] GetProcessHeap () returned 0x1130000 [0055.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c60088 [0055.359] lstrcpyW (in: lpString1=0x3c60088, lpString2="\\\\?\\C:\\Users\\Default\\NetHood" | out: lpString1="\\\\?\\C:\\Users\\Default\\NetHood") returned="\\\\?\\C:\\Users\\Default\\NetHood" [0055.359] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 97 [0055.359] QueueUserWorkItem (Function=0x129a680, Context=0x3c60088, Flags=0x0) returned 1 [0055.359] GetProcessHeap () returned 0x1130000 [0055.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c70090 [0055.360] wnsprintfW (in: pszDest=0x3c70090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood\\*") returned 30 [0055.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\NetHood\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b48e6e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.360] wnsprintfW (in: pszDest=0x3c70090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood\\read_me.txt") returned 40 [0055.360] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NetHood\\read_me.txt" (normalized: "c:\\users\\default\\nethood\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.365] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.365] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.366] CloseHandle (hObject=0x3b8) returned 1 [0055.367] GetProcessHeap () returned 0x1130000 [0055.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c70090 | out: hHeap=0x1130000) returned 1 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7a4c27fa, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT") returned 31 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG1") returned 36 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG2") returned 36 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf") returned 76 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms") returned 113 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms") returned 113 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 76 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 113 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 113 [0055.367] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0055.367] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures") returned 29 [0055.367] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0055.367] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0055.367] StrStrW (lpFirst="pictures", lpSrch="programdata") returned 0x0 [0055.367] StrStrW (lpFirst="pictures", lpSrch="$recycle.bin") returned 0x0 [0055.367] StrStrW (lpFirst="pictures", lpSrch="program files") returned 0x0 [0055.367] StrStrW (lpFirst="pictures", lpSrch="windows") returned 0x0 [0055.367] StrStrW (lpFirst="pictures", lpSrch="all users") returned 0x0 [0055.367] StrStrW (lpFirst="pictures", lpSrch="appdata") returned 0x0 [0055.367] GetProcessHeap () returned 0x1130000 [0055.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c70090 [0055.368] lstrcpyW (in: lpString1=0x3c70090, lpString2="\\\\?\\C:\\Users\\Default\\Pictures" | out: lpString1="\\\\?\\C:\\Users\\Default\\Pictures") returned="\\\\?\\C:\\Users\\Default\\Pictures" [0055.368] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 98 [0055.368] QueueUserWorkItem (Function=0x129a680, Context=0x3c70090, Flags=0x0) returned 1 [0055.368] GetProcessHeap () returned 0x1130000 [0055.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c80098 [0055.368] wnsprintfW (in: pszDest=0x3c80098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\*") returned 31 [0055.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.368] wnsprintfW (in: pszDest=0x3c80098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\.") returned 31 [0055.368] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.369] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.369] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.369] wnsprintfW (in: pszDest=0x3c80098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\..") returned 32 [0055.369] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.369] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.369] wnsprintfW (in: pszDest=0x3c80098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\read_me.txt") returned 41 [0055.369] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.369] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.369] wnsprintfW (in: pszDest=0x3c80098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\read_me.txt") returned 41 [0055.369] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\read_me.txt" (normalized: "c:\\users\\default\\pictures\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.369] GetProcessHeap () returned 0x1130000 [0055.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c80098 | out: hHeap=0x1130000) returned 1 [0055.369] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0055.369] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood") returned 30 [0055.369] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0055.369] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0055.369] StrStrW (lpFirst="printhood", lpSrch="programdata") returned 0x0 [0055.369] StrStrW (lpFirst="printhood", lpSrch="$recycle.bin") returned 0x0 [0055.369] StrStrW (lpFirst="printhood", lpSrch="program files") returned 0x0 [0055.369] StrStrW (lpFirst="printhood", lpSrch="windows") returned 0x0 [0055.369] StrStrW (lpFirst="printhood", lpSrch="all users") returned 0x0 [0055.369] StrStrW (lpFirst="printhood", lpSrch="appdata") returned 0x0 [0055.369] GetProcessHeap () returned 0x1130000 [0055.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c80098 [0055.369] lstrcpyW (in: lpString1=0x3c80098, lpString2="\\\\?\\C:\\Users\\Default\\PrintHood" | out: lpString1="\\\\?\\C:\\Users\\Default\\PrintHood") returned="\\\\?\\C:\\Users\\Default\\PrintHood" [0055.369] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 99 [0055.369] QueueUserWorkItem (Function=0x129a680, Context=0x3c80098, Flags=0x0) returned 1 [0055.369] GetProcessHeap () returned 0x1130000 [0055.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c900a0 [0055.370] wnsprintfW (in: pszDest=0x3c900a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood\\*") returned 32 [0055.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.370] wnsprintfW (in: pszDest=0x3c900a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood\\read_me.txt") returned 42 [0055.370] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\PrintHood\\read_me.txt" (normalized: "c:\\users\\default\\printhood\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.371] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.371] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.372] CloseHandle (hObject=0x3b8) returned 1 [0055.372] GetProcessHeap () returned 0x1130000 [0055.372] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c900a0 | out: hHeap=0x1130000) returned 1 [0055.372] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0055.372] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent") returned 27 [0055.372] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0055.372] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0055.372] StrStrW (lpFirst="recent", lpSrch="programdata") returned 0x0 [0055.372] StrStrW (lpFirst="recent", lpSrch="$recycle.bin") returned 0x0 [0055.372] StrStrW (lpFirst="recent", lpSrch="program files") returned 0x0 [0055.372] StrStrW (lpFirst="recent", lpSrch="windows") returned 0x0 [0055.372] StrStrW (lpFirst="recent", lpSrch="all users") returned 0x0 [0055.372] StrStrW (lpFirst="recent", lpSrch="appdata") returned 0x0 [0055.372] GetProcessHeap () returned 0x1130000 [0055.372] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c900a0 [0055.372] lstrcpyW (in: lpString1=0x3c900a0, lpString2="\\\\?\\C:\\Users\\Default\\Recent" | out: lpString1="\\\\?\\C:\\Users\\Default\\Recent") returned="\\\\?\\C:\\Users\\Default\\Recent" [0055.372] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 100 [0055.372] QueueUserWorkItem (Function=0x129a680, Context=0x3c900a0, Flags=0x0) returned 1 [0055.372] GetProcessHeap () returned 0x1130000 [0055.372] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ca00a8 [0055.373] wnsprintfW (in: pszDest=0x3ca00a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent\\*") returned 29 [0055.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Recent\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.373] wnsprintfW (in: pszDest=0x3ca00a8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent\\read_me.txt") returned 39 [0055.373] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Recent\\read_me.txt" (normalized: "c:\\users\\default\\recent\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.374] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.374] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.375] CloseHandle (hObject=0x3b8) returned 1 [0055.375] GetProcessHeap () returned 0x1130000 [0055.376] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ca00a8 | out: hHeap=0x1130000) returned 1 [0055.376] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0055.376] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games") returned 32 [0055.376] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0055.376] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0055.376] StrStrW (lpFirst="saved games", lpSrch="programdata") returned 0x0 [0055.376] StrStrW (lpFirst="saved games", lpSrch="$recycle.bin") returned 0x0 [0055.376] StrStrW (lpFirst="saved games", lpSrch="program files") returned 0x0 [0055.376] StrStrW (lpFirst="saved games", lpSrch="windows") returned 0x0 [0055.376] StrStrW (lpFirst="saved games", lpSrch="all users") returned 0x0 [0055.376] StrStrW (lpFirst="saved games", lpSrch="appdata") returned 0x0 [0055.376] GetProcessHeap () returned 0x1130000 [0055.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ca00a8 [0055.376] lstrcpyW (in: lpString1=0x3ca00a8, lpString2="\\\\?\\C:\\Users\\Default\\Saved Games" | out: lpString1="\\\\?\\C:\\Users\\Default\\Saved Games") returned="\\\\?\\C:\\Users\\Default\\Saved Games" [0055.376] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 101 [0055.376] QueueUserWorkItem (Function=0x129a680, Context=0x3ca00a8, Flags=0x0) returned 1 [0055.376] GetProcessHeap () returned 0x1130000 [0055.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cb00b0 [0055.377] wnsprintfW (in: pszDest=0x3cb00b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\*") returned 34 [0055.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.377] wnsprintfW (in: pszDest=0x3cb00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\.") returned 34 [0055.377] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.377] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.377] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.377] wnsprintfW (in: pszDest=0x3cb00b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\..") returned 35 [0055.377] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.377] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.377] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.377] wnsprintfW (in: pszDest=0x3cb00b0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\read_me.txt") returned 44 [0055.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\read_me.txt" (normalized: "c:\\users\\default\\saved games\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.378] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.378] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.378] CloseHandle (hObject=0x3b8) returned 1 [0055.379] GetProcessHeap () returned 0x1130000 [0055.379] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cb00b0 | out: hHeap=0x1130000) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0055.379] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo") returned 27 [0055.379] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0055.379] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0055.379] StrStrW (lpFirst="sendto", lpSrch="programdata") returned 0x0 [0055.379] StrStrW (lpFirst="sendto", lpSrch="$recycle.bin") returned 0x0 [0055.379] StrStrW (lpFirst="sendto", lpSrch="program files") returned 0x0 [0055.379] StrStrW (lpFirst="sendto", lpSrch="windows") returned 0x0 [0055.379] StrStrW (lpFirst="sendto", lpSrch="all users") returned 0x0 [0055.379] StrStrW (lpFirst="sendto", lpSrch="appdata") returned 0x0 [0055.379] GetProcessHeap () returned 0x1130000 [0055.379] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cb00b0 [0055.379] lstrcpyW (in: lpString1=0x3cb00b0, lpString2="\\\\?\\C:\\Users\\Default\\SendTo" | out: lpString1="\\\\?\\C:\\Users\\Default\\SendTo") returned="\\\\?\\C:\\Users\\Default\\SendTo" [0055.379] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 102 [0055.379] QueueUserWorkItem (Function=0x129a680, Context=0x3cb00b0, Flags=0x0) returned 1 [0055.379] GetProcessHeap () returned 0x1130000 [0055.379] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cc00b8 [0055.380] wnsprintfW (in: pszDest=0x3cc00b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo\\*") returned 29 [0055.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\SendTo\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.380] wnsprintfW (in: pszDest=0x3cc00b8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo\\read_me.txt") returned 39 [0055.380] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\SendTo\\read_me.txt" (normalized: "c:\\users\\default\\sendto\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.382] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.383] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.383] CloseHandle (hObject=0x3b8) returned 1 [0055.384] GetProcessHeap () returned 0x1130000 [0055.384] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cc00b8 | out: hHeap=0x1130000) returned 1 [0055.384] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0055.384] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu") returned 31 [0055.384] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0055.384] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0055.384] StrStrW (lpFirst="start menu", lpSrch="programdata") returned 0x0 [0055.384] StrStrW (lpFirst="start menu", lpSrch="$recycle.bin") returned 0x0 [0055.384] StrStrW (lpFirst="start menu", lpSrch="program files") returned 0x0 [0055.384] GetProcessHeap () returned 0x1130000 [0055.384] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cc00b8 [0055.384] lstrcpyW (in: lpString1=0x3cc00b8, lpString2="\\\\?\\C:\\Users\\Default\\Start Menu" | out: lpString1="\\\\?\\C:\\Users\\Default\\Start Menu") returned="\\\\?\\C:\\Users\\Default\\Start Menu" [0055.384] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 103 [0055.384] QueueUserWorkItem (Function=0x129a680, Context=0x3cc00b8, Flags=0x0) returned 1 [0055.384] GetProcessHeap () returned 0x1130000 [0055.384] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cd00c0 [0055.385] wnsprintfW (in: pszDest=0x3cd00c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu\\*") returned 33 [0055.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.385] wnsprintfW (in: pszDest=0x3cd00c0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu\\read_me.txt") returned 43 [0055.385] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Start Menu\\read_me.txt" (normalized: "c:\\users\\default\\start menu\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.386] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.386] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.387] CloseHandle (hObject=0x3b8) returned 1 [0055.387] GetProcessHeap () returned 0x1130000 [0055.387] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cd00c0 | out: hHeap=0x1130000) returned 1 [0055.387] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0055.387] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Templates") returned 30 [0055.387] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0055.387] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0055.387] GetProcessHeap () returned 0x1130000 [0055.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cd00c0 [0055.387] lstrcpyW (in: lpString1=0x3cd00c0, lpString2="\\\\?\\C:\\Users\\Default\\Templates" | out: lpString1="\\\\?\\C:\\Users\\Default\\Templates") returned="\\\\?\\C:\\Users\\Default\\Templates" [0055.387] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 104 [0055.387] QueueUserWorkItem (Function=0x129a680, Context=0x3cd00c0, Flags=0x0) returned 1 [0055.387] GetProcessHeap () returned 0x1130000 [0055.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ce00c8 [0055.388] wnsprintfW (in: pszDest=0x3ce00c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Templates\\*") returned 32 [0055.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Templates\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.388] wnsprintfW (in: pszDest=0x3ce00c8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Templates\\read_me.txt") returned 42 [0055.388] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Templates\\read_me.txt" (normalized: "c:\\users\\default\\templates\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.389] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.389] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.390] CloseHandle (hObject=0x3b8) returned 1 [0055.390] GetProcessHeap () returned 0x1130000 [0055.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ce00c8 | out: hHeap=0x1130000) returned 1 [0055.390] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0055.390] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos") returned 27 [0055.390] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0055.391] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0055.391] GetProcessHeap () returned 0x1130000 [0055.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ce00c8 [0055.391] lstrcpyW (in: lpString1=0x3ce00c8, lpString2="\\\\?\\C:\\Users\\Default\\Videos" | out: lpString1="\\\\?\\C:\\Users\\Default\\Videos") returned="\\\\?\\C:\\Users\\Default\\Videos" [0055.391] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 105 [0055.391] QueueUserWorkItem (Function=0x129a680, Context=0x3ce00c8, Flags=0x0) returned 1 [0055.391] GetProcessHeap () returned 0x1130000 [0055.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cf00d0 [0055.392] wnsprintfW (in: pszDest=0x3cf00d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\*") returned 29 [0055.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.392] wnsprintfW (in: pszDest=0x3cf00d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\.") returned 29 [0055.392] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.392] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.392] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.392] wnsprintfW (in: pszDest=0x3cf00d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\..") returned 30 [0055.392] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.392] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.392] wnsprintfW (in: pszDest=0x3cf00d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\read_me.txt") returned 39 [0055.392] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.392] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.392] wnsprintfW (in: pszDest=0x3cf00d0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\read_me.txt") returned 39 [0055.392] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\read_me.txt" (normalized: "c:\\users\\default\\videos\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.392] GetProcessHeap () returned 0x1130000 [0055.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cf00d0 | out: hHeap=0x1130000) returned 1 [0055.392] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="videos", cAlternateFileName="")) returned 0 [0055.392] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0055.392] wnsprintfW (in: pszDest=0x3990120, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\read_me.txt") returned 32 [0055.392] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\read_me.txt" (normalized: "c:\\users\\default\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0055.393] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.393] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0055.393] CloseHandle (hObject=0x3c0) returned 1 [0055.394] GetProcessHeap () returned 0x1130000 [0055.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3990120 | out: hHeap=0x1130000) returned 1 [0055.394] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0055.394] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default User") returned 25 [0055.394] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0055.394] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0055.394] GetProcessHeap () returned 0x1130000 [0055.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3990120 [0055.394] lstrcpyW (in: lpString1=0x3990120, lpString2="\\\\?\\C:\\Users\\Default User" | out: lpString1="\\\\?\\C:\\Users\\Default User") returned="\\\\?\\C:\\Users\\Default User" [0055.394] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 106 [0055.394] QueueUserWorkItem (Function=0x129a680, Context=0x3990120, Flags=0x0) returned 1 [0055.394] GetProcessHeap () returned 0x1130000 [0055.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cf00d0 [0055.394] wnsprintfW (in: pszDest=0x3cf00d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default User\\*") returned 27 [0055.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default User\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.394] wnsprintfW (in: pszDest=0x3cf00d0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default User\\read_me.txt") returned 37 [0055.394] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default User\\read_me.txt" (normalized: "c:\\users\\default user\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.394] GetProcessHeap () returned 0x1130000 [0055.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cf00d0 | out: hHeap=0x1130000) returned 1 [0055.394] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0055.394] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated") returned 29 [0055.394] lstrcmpW (lpString1="Default.migrated", lpString2="..") returned 1 [0055.394] lstrcmpW (lpString1="Default.migrated", lpString2=".") returned 1 [0055.394] GetProcessHeap () returned 0x1130000 [0055.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3cf00d0 [0055.394] lstrcpyW (in: lpString1=0x3cf00d0, lpString2="\\\\?\\C:\\Users\\Default.migrated" | out: lpString1="\\\\?\\C:\\Users\\Default.migrated") returned="\\\\?\\C:\\Users\\Default.migrated" [0055.394] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 107 [0055.394] QueueUserWorkItem (Function=0x129a680, Context=0x3cf00d0, Flags=0x0) returned 1 [0055.394] GetProcessHeap () returned 0x1130000 [0055.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d000d8 [0055.395] wnsprintfW (in: pszDest=0x3d000d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\*") returned 31 [0055.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default.migrated\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0055.398] wnsprintfW (in: pszDest=0x3d000d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\.") returned 31 [0055.398] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.398] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.398] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0 [0055.398] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 0 [0055.399] wnsprintfW (in: pszDest=0x3d000d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\read_me.txt") returned 41 [0055.399] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default.migrated\\read_me.txt" (normalized: "c:\\users\\default.migrated\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0055.484] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.484] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0055.484] CloseHandle (hObject=0x3c0) returned 1 [0055.485] GetProcessHeap () returned 0x1130000 [0055.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d000d8 | out: hHeap=0x1130000) returned 1 [0055.485] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.485] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\desktop.ini") returned 24 [0055.485] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0xeef958 | out: lpFindFileData=0xeef958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0055.485] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy") returned 19 [0055.485] lstrcmpW (lpString1="FD1HVy", lpString2="..") returned 1 [0055.485] lstrcmpW (lpString1="FD1HVy", lpString2=".") returned 1 [0055.485] GetProcessHeap () returned 0x1130000 [0055.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d000d8 [0055.485] lstrcpyW (in: lpString1=0x3d000d8, lpString2="\\\\?\\C:\\Users\\FD1HVy" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy") returned="\\\\?\\C:\\Users\\FD1HVy" [0055.485] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 108 [0055.485] QueueUserWorkItem (Function=0x129a680, Context=0x3d000d8, Flags=0x0) returned 1 [0055.485] GetProcessHeap () returned 0x1130000 [0055.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d100e0 [0055.486] wnsprintfW (in: pszDest=0x3d100e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\*") returned 21 [0055.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0055.486] wnsprintfW (in: pszDest=0x3d100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\.") returned 21 [0055.486] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.486] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.486] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.486] wnsprintfW (in: pszDest=0x3d100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\..") returned 22 [0055.486] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.486] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0055.486] wnsprintfW (in: pszDest=0x3d100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\AppData") returned 27 [0055.486] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0055.486] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0055.486] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0055.486] wnsprintfW (in: pszDest=0x3d100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Application Data") returned 36 [0055.486] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0055.486] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0055.486] GetProcessHeap () returned 0x1130000 [0055.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d200e8 [0055.487] lstrcpyW (in: lpString1=0x3d200e8, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Application Data" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Application Data") returned="\\\\?\\C:\\Users\\FD1HVy\\Application Data" [0055.487] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 109 [0055.487] QueueUserWorkItem (Function=0x129a680, Context=0x3d200e8, Flags=0x0) returned 1 [0055.487] GetProcessHeap () returned 0x1130000 [0055.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d300f0 [0055.488] wnsprintfW (in: pszDest=0x3d300f0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Application Data\\*") returned 38 [0055.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.489] wnsprintfW (in: pszDest=0x3d300f0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Application Data\\read_me.txt") returned 48 [0055.489] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Application Data\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\application data\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.489] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.489] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.490] CloseHandle (hObject=0x3b8) returned 1 [0055.490] GetProcessHeap () returned 0x1130000 [0055.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d300f0 | out: hHeap=0x1130000) returned 1 [0055.490] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0055.490] wnsprintfW (in: pszDest=0x3d100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts") returned 28 [0055.490] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0055.490] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0055.490] GetProcessHeap () returned 0x1130000 [0055.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d300f0 [0055.490] lstrcpyW (in: lpString1=0x3d300f0, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Contacts" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Contacts") returned="\\\\?\\C:\\Users\\FD1HVy\\Contacts" [0055.490] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 110 [0055.490] QueueUserWorkItem (Function=0x129a680, Context=0x3d300f0, Flags=0x0) returned 1 [0055.490] GetProcessHeap () returned 0x1130000 [0055.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d400f8 [0055.491] wnsprintfW (in: pszDest=0x3d400f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\*") returned 30 [0055.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.491] wnsprintfW (in: pszDest=0x3d400f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\.") returned 30 [0055.491] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.492] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.492] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.492] wnsprintfW (in: pszDest=0x3d400f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\..") returned 31 [0055.492] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.492] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.492] wnsprintfW (in: pszDest=0x3d400f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\desktop.ini") returned 40 [0055.492] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0055.492] FindClose (in: hFindFile=0x1170aa0 | out: hFindFile=0x1170aa0) returned 1 [0055.492] wnsprintfW (in: pszDest=0x3d400f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\read_me.txt") returned 40 [0055.492] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\contacts\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.492] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.492] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.493] CloseHandle (hObject=0x3b8) returned 1 [0055.494] GetProcessHeap () returned 0x1130000 [0055.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d400f8 | out: hHeap=0x1130000) returned 1 [0055.494] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0055.494] wnsprintfW (in: pszDest=0x3d100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Cookies") returned 27 [0055.494] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0055.494] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0055.494] GetProcessHeap () returned 0x1130000 [0055.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d400f8 [0055.494] lstrcpyW (in: lpString1=0x3d400f8, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Cookies" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Cookies") returned="\\\\?\\C:\\Users\\FD1HVy\\Cookies" [0055.494] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 111 [0055.494] QueueUserWorkItem (Function=0x129a680, Context=0x3d400f8, Flags=0x0) returned 1 [0055.494] GetProcessHeap () returned 0x1130000 [0055.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d50100 [0055.495] wnsprintfW (in: pszDest=0x3d50100, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Cookies\\*") returned 29 [0055.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.495] wnsprintfW (in: pszDest=0x3d50100, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Cookies\\read_me.txt") returned 39 [0055.495] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Cookies\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\cookies\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.496] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.496] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.497] CloseHandle (hObject=0x3b8) returned 1 [0055.497] GetProcessHeap () returned 0x1130000 [0055.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d50100 | out: hHeap=0x1130000) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xda534aa5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xda534aa5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0055.498] wnsprintfW (in: pszDest=0x3d100e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop") returned 27 [0055.498] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0055.498] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0055.498] GetProcessHeap () returned 0x1130000 [0055.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d50100 [0055.498] lstrcpyW (in: lpString1=0x3d50100, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Desktop" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Desktop") returned="\\\\?\\C:\\Users\\FD1HVy\\Desktop" [0055.498] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 112 [0055.498] QueueUserWorkItem (Function=0x129a680, Context=0x3d50100, Flags=0x0) returned 1 [0055.498] GetProcessHeap () returned 0x1130000 [0055.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d60108 [0055.499] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\*") returned 29 [0055.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xda534aa5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xda534aa5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.499] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\.") returned 29 [0055.499] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.499] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.499] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xda534aa5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xda534aa5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.499] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\..") returned 30 [0055.499] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.499] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x134e6990, ftCreationTime.dwHighDateTime=0x1d4d521, ftLastAccessTime.dwLowDateTime=0x26858590, ftLastAccessTime.dwHighDateTime=0x1d4ceee, ftLastWriteTime.dwLowDateTime=0x26858590, ftLastWriteTime.dwHighDateTime=0x1d4ceee, nFileSizeHigh=0x0, nFileSizeLow=0x7804, dwReserved0=0x2, dwReserved1=0x0, cFileName="-xYY0z.ppt", cAlternateFileName="")) returned 1 [0055.499] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\-xYY0z.ppt") returned 38 [0055.499] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ec4a10, ftCreationTime.dwHighDateTime=0x1d4d42b, ftLastAccessTime.dwLowDateTime=0xd5172230, ftLastAccessTime.dwHighDateTime=0x1d4cd5e, ftLastWriteTime.dwLowDateTime=0xd5172230, ftLastWriteTime.dwHighDateTime=0x1d4cd5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb34, dwReserved0=0x2, dwReserved1=0x0, cFileName="0EN_neRNTBxb92nCUV.mp4", cAlternateFileName="0EN_NE~1.MP4")) returned 1 [0055.499] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0EN_neRNTBxb92nCUV.mp4") returned 50 [0055.499] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b1d4d0, ftCreationTime.dwHighDateTime=0x1d4ce65, ftLastAccessTime.dwLowDateTime=0xe2f95400, ftLastAccessTime.dwHighDateTime=0x1d4d032, ftLastWriteTime.dwLowDateTime=0xe2f95400, ftLastWriteTime.dwHighDateTime=0x1d4d032, nFileSizeHigh=0x0, nFileSizeLow=0xb7be, dwReserved0=0x2, dwReserved1=0x0, cFileName="0kYErnuNXsN-UIs9H2I.mkv", cAlternateFileName="0KYERN~1.MKV")) returned 1 [0055.499] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0kYErnuNXsN-UIs9H2I.mkv") returned 51 [0055.499] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef1e8f0, ftCreationTime.dwHighDateTime=0x1d4d37b, ftLastAccessTime.dwLowDateTime=0x6cffbd50, ftLastAccessTime.dwHighDateTime=0x1d4cf80, ftLastWriteTime.dwLowDateTime=0x6cffbd50, ftLastWriteTime.dwHighDateTime=0x1d4cf80, nFileSizeHigh=0x0, nFileSizeLow=0x8d8, dwReserved0=0x2, dwReserved1=0x0, cFileName="1LyFNLFLMMM k.mkv", cAlternateFileName="1LYFNL~1.MKV")) returned 1 [0055.499] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\1LyFNLFLMMM k.mkv") returned 45 [0055.500] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb8e6b0, ftCreationTime.dwHighDateTime=0x1d4d39b, ftLastAccessTime.dwLowDateTime=0x3b8a5ce0, ftLastAccessTime.dwHighDateTime=0x1d4cdc2, ftLastWriteTime.dwLowDateTime=0x3b8a5ce0, ftLastWriteTime.dwHighDateTime=0x1d4cdc2, nFileSizeHigh=0x0, nFileSizeLow=0x6779, dwReserved0=0x2, dwReserved1=0x0, cFileName="2AyeNwkWu8g.swf", cAlternateFileName="2AYENW~1.SWF")) returned 1 [0055.500] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2AyeNwkWu8g.swf") returned 43 [0055.500] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccad250, ftCreationTime.dwHighDateTime=0x1d4cabf, ftLastAccessTime.dwLowDateTime=0x3bbb9250, ftLastAccessTime.dwHighDateTime=0x1d4cb8e, ftLastWriteTime.dwLowDateTime=0x3bbb9250, ftLastWriteTime.dwHighDateTime=0x1d4cb8e, nFileSizeHigh=0x0, nFileSizeLow=0x1897c, dwReserved0=0x2, dwReserved1=0x0, cFileName="2kfNn.bmp", cAlternateFileName="")) returned 1 [0055.500] wnsprintfW (in: pszDest=0x3d60108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2kfNn.bmp") returned 37 [0055.500] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1165a080, ftCreationTime.dwHighDateTime=0x1d4c7e8, ftLastAccessTime.dwLowDateTime=0x443f2c40, ftLastAccessTime.dwHighDateTime=0x1d4d2a3, ftLastWriteTime.dwLowDateTime=0x443f2c40, ftLastWriteTime.dwHighDateTime=0x1d4d2a3, nFileSizeHigh=0x0, nFileSizeLow=0xd052, dwReserved0=0x2, dwReserved1=0x0, cFileName="3iUqwwmnNDpVFv0rv.mp3", cAlternateFileName="3IUQWW~1.MP3")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f69bff0, ftCreationTime.dwHighDateTime=0x1d4c6c9, ftLastAccessTime.dwLowDateTime=0x9d023cf0, ftLastAccessTime.dwHighDateTime=0x1d4d177, ftLastWriteTime.dwLowDateTime=0x9d023cf0, ftLastWriteTime.dwHighDateTime=0x1d4d177, nFileSizeHigh=0x0, nFileSizeLow=0x11e9e, dwReserved0=0x2, dwReserved1=0x0, cFileName="4cKe6MWXhvPrE.bmp", cAlternateFileName="4CKE6M~1.BMP")) returned 1 [0055.500] lstrcmpW (lpString1="Cjy 1RG4ITB4tJEzx-vR", lpString2="..") returned 1 [0055.500] lstrcmpW (lpString1="Cjy 1RG4ITB4tJEzx-vR", lpString2=".") returned 1 [0055.500] GetProcessHeap () returned 0x1130000 [0055.500] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d70110 [0055.501] lstrcpyW (in: lpString1=0x3d70110, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR") returned="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR" [0055.501] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 113 [0055.501] QueueUserWorkItem (Function=0x129a680, Context=0x3d70110, Flags=0x0) returned 1 [0055.501] GetProcessHeap () returned 0x1130000 [0055.501] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d80118 [0055.502] wnsprintfW (in: pszDest=0x3d80118, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\*") returned 50 [0055.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a6d1c0, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x752eb60, ftLastAccessTime.dwHighDateTime=0x1d4c613, ftLastWriteTime.dwLowDateTime=0x752eb60, ftLastWriteTime.dwHighDateTime=0x1d4c613, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.502] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.502] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.503] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.508] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.508] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.509] CloseHandle (hObject=0x3b4) returned 1 [0055.509] GetProcessHeap () returned 0x1130000 [0055.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d80118 | out: hHeap=0x1130000) returned 1 [0055.509] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.509] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.510] CloseHandle (hObject=0x3b8) returned 1 [0055.510] GetProcessHeap () returned 0x1130000 [0055.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d60108 | out: hHeap=0x1130000) returned 1 [0055.510] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0055.510] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0055.510] GetProcessHeap () returned 0x1130000 [0055.510] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d60108 [0055.510] lstrcpyW (in: lpString1=0x3d60108, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents" [0055.510] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 114 [0055.510] QueueUserWorkItem (Function=0x129a680, Context=0x3d60108, Flags=0x0) returned 1 [0055.510] GetProcessHeap () returned 0x1130000 [0055.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d80118 [0055.511] wnsprintfW (in: pszDest=0x3d80118, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\*") returned 31 [0055.511] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd5714832, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xd5714832, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.511] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.511] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.511] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.511] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0055.511] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0055.511] GetProcessHeap () returned 0x1130000 [0055.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d90120 [0055.512] lstrcpyW (in: lpString1=0x3d90120, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music" [0055.512] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 115 [0055.512] QueueUserWorkItem (Function=0x129a680, Context=0x3d90120, Flags=0x0) returned 1 [0055.512] GetProcessHeap () returned 0x1130000 [0055.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3da0128 [0055.513] wnsprintfW (in: pszDest=0x3da0128, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music\\*") returned 40 [0055.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.513] wnsprintfW (in: pszDest=0x3da0128, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music\\read_me.txt") returned 50 [0055.513] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my music\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0055.513] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.513] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.514] CloseHandle (hObject=0x3b4) returned 1 [0055.514] GetProcessHeap () returned 0x1130000 [0055.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3da0128 | out: hHeap=0x1130000) returned 1 [0055.514] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0055.514] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0055.514] GetProcessHeap () returned 0x1130000 [0055.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3da0128 [0055.515] lstrcpyW (in: lpString1=0x3da0128, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures" [0055.515] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 116 [0055.515] QueueUserWorkItem (Function=0x129a680, Context=0x3da0128, Flags=0x0) returned 1 [0055.515] GetProcessHeap () returned 0x1130000 [0055.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3db0130 [0055.516] wnsprintfW (in: pszDest=0x3db0130, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures\\*") returned 43 [0055.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.516] wnsprintfW (in: pszDest=0x3db0130, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures\\read_me.txt") returned 53 [0055.516] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0055.516] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.516] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.517] CloseHandle (hObject=0x3b4) returned 1 [0055.517] GetProcessHeap () returned 0x1130000 [0055.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3db0130 | out: hHeap=0x1130000) returned 1 [0055.517] lstrcmpW (lpString1="My Shapes", lpString2="..") returned 1 [0055.517] lstrcmpW (lpString1="My Shapes", lpString2=".") returned 1 [0055.517] GetProcessHeap () returned 0x1130000 [0055.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3db0130 [0055.517] lstrcpyW (in: lpString1=0x3db0130, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes" [0055.518] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 117 [0055.518] QueueUserWorkItem (Function=0x129a680, Context=0x3db0130, Flags=0x0) returned 1 [0055.518] GetProcessHeap () returned 0x1130000 [0055.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3dc0138 [0055.518] wnsprintfW (in: pszDest=0x3dc0138, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\*") returned 41 [0055.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.609] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.609] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.609] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.609] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0055.609] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0055.609] GetProcessHeap () returned 0x1130000 [0055.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3dd0140 [0055.610] lstrcpyW (in: lpString1=0x3dd0140, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" [0055.610] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 118 [0055.610] QueueUserWorkItem (Function=0x129a680, Context=0x3dd0140, Flags=0x0) returned 1 [0055.610] GetProcessHeap () returned 0x1130000 [0055.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3de0148 [0055.611] wnsprintfW (in: pszDest=0x3de0148, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*") returned 50 [0055.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0xeeef78 | out: lpFindFileData=0xeeef78*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.612] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.612] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.612] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.613] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.613] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef1dc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef1dc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.614] CloseHandle (hObject=0x3b4) returned 1 [0055.614] GetProcessHeap () returned 0x1130000 [0055.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3de0148 | out: hHeap=0x1130000) returned 1 [0055.614] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.614] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.615] CloseHandle (hObject=0x3c0) returned 1 [0055.615] GetProcessHeap () returned 0x1130000 [0055.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3dc0138 | out: hHeap=0x1130000) returned 1 [0055.615] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0055.615] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0055.615] GetProcessHeap () returned 0x1130000 [0055.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3dc0138 [0055.615] lstrcpyW (in: lpString1=0x3dc0138, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos" [0055.615] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 119 [0055.615] QueueUserWorkItem (Function=0x129a680, Context=0x3dc0138, Flags=0x0) returned 1 [0055.615] GetProcessHeap () returned 0x1130000 [0055.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3de0148 [0055.615] wnsprintfW (in: pszDest=0x3de0148, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos\\*") returned 41 [0055.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.616] wnsprintfW (in: pszDest=0x3de0148, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos\\read_me.txt") returned 51 [0055.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my videos\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0055.616] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.616] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.617] CloseHandle (hObject=0x3c0) returned 1 [0055.617] GetProcessHeap () returned 0x1130000 [0055.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3de0148 | out: hHeap=0x1130000) returned 1 [0055.617] lstrcmpW (lpString1="Nj_YqnRaj2", lpString2="..") returned 1 [0055.617] lstrcmpW (lpString1="Nj_YqnRaj2", lpString2=".") returned 1 [0055.617] GetProcessHeap () returned 0x1130000 [0055.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3de0148 [0055.617] lstrcpyW (in: lpString1=0x3de0148, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2" [0055.617] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 120 [0055.617] QueueUserWorkItem (Function=0x129a680, Context=0x3de0148, Flags=0x0) returned 1 [0055.617] GetProcessHeap () returned 0x1130000 [0055.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3df0150 [0055.618] wnsprintfW (in: pszDest=0x3df0150, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\*") returned 42 [0055.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc98ef1e0, ftCreationTime.dwHighDateTime=0x1d4c859, ftLastAccessTime.dwLowDateTime=0x70350dd0, ftLastAccessTime.dwHighDateTime=0x1d4cd06, ftLastWriteTime.dwLowDateTime=0x70350dd0, ftLastWriteTime.dwHighDateTime=0x1d4cd06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.618] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.618] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.618] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.618] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.618] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.619] CloseHandle (hObject=0x3c0) returned 1 [0055.619] GetProcessHeap () returned 0x1130000 [0055.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3df0150 | out: hHeap=0x1130000) returned 1 [0055.620] lstrcmpW (lpString1="ODxegLUCjB3vxT6qFqgY", lpString2="..") returned 1 [0055.620] lstrcmpW (lpString1="ODxegLUCjB3vxT6qFqgY", lpString2=".") returned 1 [0055.620] GetProcessHeap () returned 0x1130000 [0055.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3df0150 [0055.620] lstrcpyW (in: lpString1=0x3df0150, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY" [0055.620] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 121 [0055.620] QueueUserWorkItem (Function=0x129a680, Context=0x3df0150, Flags=0x0) returned 1 [0055.620] GetProcessHeap () returned 0x1130000 [0055.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e00158 [0055.621] wnsprintfW (in: pszDest=0x3e00158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\*") returned 52 [0055.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f12fc50, ftCreationTime.dwHighDateTime=0x1d4cbf1, ftLastAccessTime.dwLowDateTime=0x78738950, ftLastAccessTime.dwHighDateTime=0x1d4d0b6, ftLastWriteTime.dwLowDateTime=0x78738950, ftLastWriteTime.dwHighDateTime=0x1d4d0b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.621] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.621] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.621] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.622] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.622] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.623] CloseHandle (hObject=0x3c0) returned 1 [0055.623] GetProcessHeap () returned 0x1130000 [0055.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e00158 | out: hHeap=0x1130000) returned 1 [0055.623] lstrcmpW (lpString1="Outlook Files", lpString2="..") returned 1 [0055.623] lstrcmpW (lpString1="Outlook Files", lpString2=".") returned 1 [0055.623] GetProcessHeap () returned 0x1130000 [0055.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e00158 [0055.623] lstrcpyW (in: lpString1=0x3e00158, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0055.623] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 122 [0055.623] QueueUserWorkItem (Function=0x129a680, Context=0x3e00158, Flags=0x0) returned 1 [0055.623] GetProcessHeap () returned 0x1130000 [0055.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e10160 [0055.624] wnsprintfW (in: pszDest=0x3e10160, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*") returned 45 [0055.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.625] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.625] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.625] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.625] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.625] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.626] CloseHandle (hObject=0x3c0) returned 1 [0055.626] GetProcessHeap () returned 0x1130000 [0055.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e10160 | out: hHeap=0x1130000) returned 1 [0055.626] lstrcmpW (lpString1="v2ue", lpString2="..") returned 1 [0055.626] lstrcmpW (lpString1="v2ue", lpString2=".") returned 1 [0055.627] GetProcessHeap () returned 0x1130000 [0055.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e10160 [0055.627] lstrcpyW (in: lpString1=0x3e10160, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue" [0055.627] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 123 [0055.627] QueueUserWorkItem (Function=0x129a680, Context=0x3e10160, Flags=0x0) returned 1 [0055.627] GetProcessHeap () returned 0x1130000 [0055.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e20168 [0055.628] wnsprintfW (in: pszDest=0x3e20168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\*") returned 36 [0055.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d2f2080, ftCreationTime.dwHighDateTime=0x1d4cb35, ftLastAccessTime.dwLowDateTime=0x313259c0, ftLastAccessTime.dwHighDateTime=0x1d4cc8f, ftLastWriteTime.dwLowDateTime=0x313259c0, ftLastWriteTime.dwHighDateTime=0x1d4cc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.628] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.628] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.628] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.628] lstrcmpW (lpString1="hIDeDKWHFj4z", lpString2="..") returned 1 [0055.628] lstrcmpW (lpString1="hIDeDKWHFj4z", lpString2=".") returned 1 [0055.628] GetProcessHeap () returned 0x1130000 [0055.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e30170 [0055.629] lstrcpyW (in: lpString1=0x3e30170, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z" [0055.629] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 124 [0055.629] QueueUserWorkItem (Function=0x129a680, Context=0x3e30170, Flags=0x0) returned 1 [0055.629] GetProcessHeap () returned 0x1130000 [0055.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e40178 [0055.630] wnsprintfW (in: pszDest=0x3e40178, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\*") returned 49 [0055.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\*", lpFindFileData=0xeeef78 | out: lpFindFileData=0xeeef78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92b83d60, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x976f4c0, ftLastAccessTime.dwHighDateTime=0x1d4c5cf, ftLastWriteTime.dwLowDateTime=0x976f4c0, ftLastWriteTime.dwHighDateTime=0x1d4c5cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.630] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.630] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.630] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.632] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.632] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef1dc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef1dc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.633] CloseHandle (hObject=0x3b4) returned 1 [0055.633] GetProcessHeap () returned 0x1130000 [0055.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e40178 | out: hHeap=0x1130000) returned 1 [0055.633] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.633] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.634] CloseHandle (hObject=0x3c0) returned 1 [0055.634] GetProcessHeap () returned 0x1130000 [0055.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e20168 | out: hHeap=0x1130000) returned 1 [0055.634] lstrcmpW (lpString1="xP9DBmCz", lpString2="..") returned 1 [0055.634] lstrcmpW (lpString1="xP9DBmCz", lpString2=".") returned 1 [0055.634] GetProcessHeap () returned 0x1130000 [0055.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e20168 [0055.634] lstrcpyW (in: lpString1=0x3e20168, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz" [0055.634] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 125 [0055.634] QueueUserWorkItem (Function=0x129a680, Context=0x3e20168, Flags=0x0) returned 1 [0055.634] GetProcessHeap () returned 0x1130000 [0055.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e40178 [0055.634] wnsprintfW (in: pszDest=0x3e40178, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\*") returned 40 [0055.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39b3eb0, ftCreationTime.dwHighDateTime=0x1d4cbb2, ftLastAccessTime.dwLowDateTime=0x113e4eb0, ftLastAccessTime.dwHighDateTime=0x1d4cfc5, ftLastWriteTime.dwLowDateTime=0x113e4eb0, ftLastWriteTime.dwHighDateTime=0x1d4cfc5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.635] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.635] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.635] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.635] lstrcmpW (lpString1="7_V10g7t2YlS2cpn", lpString2="..") returned 1 [0055.635] lstrcmpW (lpString1="7_V10g7t2YlS2cpn", lpString2=".") returned 1 [0055.635] GetProcessHeap () returned 0x1130000 [0055.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e50180 [0055.636] lstrcpyW (in: lpString1=0x3e50180, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn" [0055.636] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 126 [0055.636] QueueUserWorkItem (Function=0x129a680, Context=0x3e50180, Flags=0x0) returned 1 [0055.636] GetProcessHeap () returned 0x1130000 [0055.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e60188 [0055.637] wnsprintfW (in: pszDest=0x3e60188, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\*") returned 57 [0055.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\*", lpFindFileData=0xeeef78 | out: lpFindFileData=0xeeef78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x356420a0, ftCreationTime.dwHighDateTime=0x1d4d081, ftLastAccessTime.dwLowDateTime=0xb4de29d0, ftLastAccessTime.dwHighDateTime=0x1d4d350, ftLastWriteTime.dwLowDateTime=0xb4de29d0, ftLastWriteTime.dwHighDateTime=0x1d4d350, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.637] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.637] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.637] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.638] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.638] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef1dc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef1dc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.639] CloseHandle (hObject=0x3b4) returned 1 [0055.639] GetProcessHeap () returned 0x1130000 [0055.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e60188 | out: hHeap=0x1130000) returned 1 [0055.639] lstrcmpW (lpString1="h9sKpMkAZwo9DO2y-", lpString2="..") returned 1 [0055.639] lstrcmpW (lpString1="h9sKpMkAZwo9DO2y-", lpString2=".") returned 1 [0055.639] GetProcessHeap () returned 0x1130000 [0055.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e60188 [0055.639] lstrcpyW (in: lpString1=0x3e60188, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-" [0055.639] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 127 [0055.639] QueueUserWorkItem (Function=0x129a680, Context=0x3e60188, Flags=0x0) returned 1 [0055.639] GetProcessHeap () returned 0x1130000 [0055.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e70190 [0055.640] wnsprintfW (in: pszDest=0x3e70190, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\*") returned 58 [0055.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\*", lpFindFileData=0xeeef78 | out: lpFindFileData=0xeeef78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc875a720, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x2f226540, ftLastAccessTime.dwHighDateTime=0x1d4d481, ftLastWriteTime.dwLowDateTime=0x2f226540, ftLastWriteTime.dwHighDateTime=0x1d4d481, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.640] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.640] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.640] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.640] lstrcmpW (lpString1="cEN69gCeZ75mL9uAJ", lpString2="..") returned 1 [0055.640] lstrcmpW (lpString1="cEN69gCeZ75mL9uAJ", lpString2=".") returned 1 [0055.640] GetProcessHeap () returned 0x1130000 [0055.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e80198 [0055.641] lstrcpyW (in: lpString1=0x3e80198, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ" [0055.641] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 128 [0055.641] QueueUserWorkItem (Function=0x129a680, Context=0x3e80198, Flags=0x0) returned 1 [0055.641] GetProcessHeap () returned 0x1130000 [0055.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e901a0 [0055.642] wnsprintfW (in: pszDest=0x3e901a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\*") returned 76 [0055.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\*", lpFindFileData=0xeeed00 | out: lpFindFileData=0xeeed00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf717b080, ftCreationTime.dwHighDateTime=0x1d4d046, ftLastAccessTime.dwLowDateTime=0x62c7f230, ftLastAccessTime.dwHighDateTime=0x1d4d2c8, ftLastWriteTime.dwLowDateTime=0x62c7f230, ftLastWriteTime.dwHighDateTime=0x1d4d2c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0055.642] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.642] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.643] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.643] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.643] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeef64, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeef64*=0x9d7, lpOverlapped=0x0) returned 1 [0055.644] CloseHandle (hObject=0x3bc) returned 1 [0055.644] GetProcessHeap () returned 0x1130000 [0055.644] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e901a0 | out: hHeap=0x1130000) returned 1 [0055.644] lstrcmpW (lpString1="u-VOaNfHFZ-", lpString2="..") returned 1 [0055.644] lstrcmpW (lpString1="u-VOaNfHFZ-", lpString2=".") returned 1 [0055.644] GetProcessHeap () returned 0x1130000 [0055.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e901a0 [0055.644] lstrcpyW (in: lpString1=0x3e901a0, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-") returned="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-" [0055.644] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 129 [0055.644] QueueUserWorkItem (Function=0x129a680, Context=0x3e901a0, Flags=0x0) returned 1 [0055.644] GetProcessHeap () returned 0x1130000 [0055.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ea01a8 [0055.645] wnsprintfW (in: pszDest=0x3ea01a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\*") returned 70 [0055.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\*", lpFindFileData=0xeeed00 | out: lpFindFileData=0xeeed00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf09030c0, ftCreationTime.dwHighDateTime=0x1d4cb0a, ftLastAccessTime.dwLowDateTime=0x35528640, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0x35528640, ftLastWriteTime.dwHighDateTime=0x1d4d367, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0055.645] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.645] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.645] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.646] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.646] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeef64, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeef64*=0x9d7, lpOverlapped=0x0) returned 1 [0055.647] CloseHandle (hObject=0x3bc) returned 1 [0055.647] GetProcessHeap () returned 0x1130000 [0055.647] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ea01a8 | out: hHeap=0x1130000) returned 1 [0055.647] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.647] WriteFile (in: hFile=0x3b4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef1dc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef1dc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.648] CloseHandle (hObject=0x3b4) returned 1 [0055.648] GetProcessHeap () returned 0x1130000 [0055.648] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e70190 | out: hHeap=0x1130000) returned 1 [0055.761] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.761] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.762] CloseHandle (hObject=0x3c0) returned 1 [0055.762] GetProcessHeap () returned 0x1130000 [0055.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e40178 | out: hHeap=0x1130000) returned 1 [0055.762] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.762] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.763] CloseHandle (hObject=0x3b8) returned 1 [0055.763] GetProcessHeap () returned 0x1130000 [0055.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d80118 | out: hHeap=0x1130000) returned 1 [0055.763] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0055.763] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0055.763] GetProcessHeap () returned 0x1130000 [0055.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d80118 [0055.763] lstrcpyW (in: lpString1=0x3d80118, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Downloads" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Downloads") returned="\\\\?\\C:\\Users\\FD1HVy\\Downloads" [0055.763] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 130 [0055.763] QueueUserWorkItem (Function=0x129a680, Context=0x3d80118, Flags=0x0) returned 1 [0055.763] GetProcessHeap () returned 0x1130000 [0055.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e40178 [0055.763] wnsprintfW (in: pszDest=0x3e40178, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Downloads\\*") returned 31 [0055.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.764] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.764] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.764] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.764] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.764] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.765] CloseHandle (hObject=0x3b8) returned 1 [0055.765] GetProcessHeap () returned 0x1130000 [0055.765] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e40178 | out: hHeap=0x1130000) returned 1 [0055.765] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0055.765] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0055.765] GetProcessHeap () returned 0x1130000 [0055.765] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e40178 [0055.765] lstrcpyW (in: lpString1=0x3e40178, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Favorites" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Favorites") returned="\\\\?\\C:\\Users\\FD1HVy\\Favorites" [0055.765] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 131 [0055.765] QueueUserWorkItem (Function=0x129a680, Context=0x3e40178, Flags=0x0) returned 1 [0055.765] GetProcessHeap () returned 0x1130000 [0055.765] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e70190 [0055.765] wnsprintfW (in: pszDest=0x3e70190, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\*") returned 31 [0055.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.766] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.766] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.766] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.766] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0055.766] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0055.766] GetProcessHeap () returned 0x1130000 [0055.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ea01a8 [0055.766] lstrcpyW (in: lpString1=0x3ea01a8, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links") returned="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links" [0055.766] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 132 [0055.766] QueueUserWorkItem (Function=0x129a680, Context=0x3ea01a8, Flags=0x0) returned 1 [0055.766] GetProcessHeap () returned 0x1130000 [0055.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3eb01b0 [0055.767] wnsprintfW (in: pszDest=0x3eb01b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links\\*") returned 37 [0055.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.768] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.768] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.768] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.769] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.769] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.769] CloseHandle (hObject=0x3c0) returned 1 [0055.769] GetProcessHeap () returned 0x1130000 [0055.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3eb01b0 | out: hHeap=0x1130000) returned 1 [0055.770] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.770] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.771] CloseHandle (hObject=0x3b8) returned 1 [0055.771] GetProcessHeap () returned 0x1130000 [0055.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e70190 | out: hHeap=0x1130000) returned 1 [0055.771] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0055.772] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0055.772] GetProcessHeap () returned 0x1130000 [0055.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e70190 [0055.772] lstrcpyW (in: lpString1=0x3e70190, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Links" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Links") returned="\\\\?\\C:\\Users\\FD1HVy\\Links" [0055.772] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 133 [0055.772] QueueUserWorkItem (Function=0x129a680, Context=0x3e70190, Flags=0x0) returned 1 [0055.772] GetProcessHeap () returned 0x1130000 [0055.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3eb01b0 [0055.772] wnsprintfW (in: pszDest=0x3eb01b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\*") returned 27 [0055.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.772] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.772] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.772] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.772] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.772] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.773] CloseHandle (hObject=0x3b8) returned 1 [0055.773] GetProcessHeap () returned 0x1130000 [0055.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3eb01b0 | out: hHeap=0x1130000) returned 1 [0055.773] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0055.773] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0055.773] GetProcessHeap () returned 0x1130000 [0055.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3eb01b0 [0055.773] lstrcpyW (in: lpString1=0x3eb01b0, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Local Settings" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Local Settings") returned="\\\\?\\C:\\Users\\FD1HVy\\Local Settings" [0055.773] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 134 [0055.773] QueueUserWorkItem (Function=0x129a680, Context=0x3eb01b0, Flags=0x0) returned 1 [0055.773] GetProcessHeap () returned 0x1130000 [0055.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ec01b8 [0055.774] wnsprintfW (in: pszDest=0x3ec01b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Local Settings\\*") returned 36 [0055.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.774] wnsprintfW (in: pszDest=0x3ec01b8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Local Settings\\read_me.txt") returned 46 [0055.775] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Local Settings\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\local settings\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.775] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.775] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.776] CloseHandle (hObject=0x3b8) returned 1 [0055.776] GetProcessHeap () returned 0x1130000 [0055.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ec01b8 | out: hHeap=0x1130000) returned 1 [0055.776] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0055.776] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0055.776] GetProcessHeap () returned 0x1130000 [0055.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ec01b8 [0055.776] lstrcpyW (in: lpString1=0x3ec01b8, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music") returned="\\\\?\\C:\\Users\\FD1HVy\\Music" [0055.776] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 135 [0055.776] QueueUserWorkItem (Function=0x129a680, Context=0x3ec01b8, Flags=0x0) returned 1 [0055.776] GetProcessHeap () returned 0x1130000 [0055.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ed01c0 [0055.777] wnsprintfW (in: pszDest=0x3ed01c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\*") returned 27 [0055.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd5786f06, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.777] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.777] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.777] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.777] lstrcmpW (lpString1="4FTiJ2yRkuQl_WF f1B", lpString2="..") returned 1 [0055.778] lstrcmpW (lpString1="4FTiJ2yRkuQl_WF f1B", lpString2=".") returned 1 [0055.778] GetProcessHeap () returned 0x1130000 [0055.778] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0055.778] lstrcpyW (in: lpString1=0x3ee01c8, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B" [0055.778] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 136 [0055.778] QueueUserWorkItem (Function=0x129a680, Context=0x3ee01c8, Flags=0x0) returned 1 [0055.778] GetProcessHeap () returned 0x1130000 [0055.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ef01d0 [0055.779] wnsprintfW (in: pszDest=0x3ef01d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\*") returned 47 [0055.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ae59f0, ftCreationTime.dwHighDateTime=0x1d4c782, ftLastAccessTime.dwLowDateTime=0x4f1f69c0, ftLastAccessTime.dwHighDateTime=0x1d4d4a8, ftLastWriteTime.dwLowDateTime=0x4f1f69c0, ftLastWriteTime.dwHighDateTime=0x1d4d4a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.780] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.780] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.780] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.780] lstrcmpW (lpString1="e4orhIul1aBHqg8KZabc", lpString2="..") returned 1 [0055.780] lstrcmpW (lpString1="e4orhIul1aBHqg8KZabc", lpString2=".") returned 1 [0055.780] GetProcessHeap () returned 0x1130000 [0055.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0055.781] lstrcpyW (in: lpString1=0x3f001d8, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc" [0055.781] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 137 [0055.781] QueueUserWorkItem (Function=0x129a680, Context=0x3f001d8, Flags=0x0) returned 1 [0055.781] GetProcessHeap () returned 0x1130000 [0055.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f101e0 [0055.781] wnsprintfW (in: pszDest=0x3f101e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\*") returned 68 [0055.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\*", lpFindFileData=0xeeef78 | out: lpFindFileData=0xeeef78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50588790, ftCreationTime.dwHighDateTime=0x1d4d50c, ftLastAccessTime.dwLowDateTime=0xf17e1ea0, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0xf17e1ea0, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.782] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.782] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.782] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.782] lstrcmpW (lpString1="TpUlLJCtEsEy_-", lpString2="..") returned 1 [0055.782] lstrcmpW (lpString1="TpUlLJCtEsEy_-", lpString2=".") returned 1 [0055.782] GetProcessHeap () returned 0x1130000 [0055.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0055.783] lstrcpyW (in: lpString1=0x3f201e8, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-" [0055.783] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 138 [0055.783] QueueUserWorkItem (Function=0x129a680, Context=0x3f201e8, Flags=0x0) returned 1 [0055.783] GetProcessHeap () returned 0x1130000 [0055.783] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f301f0 [0055.784] wnsprintfW (in: pszDest=0x3f301f0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\*") returned 83 [0055.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\*", lpFindFileData=0xeeed00 | out: lpFindFileData=0xeeed00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60e739b0, ftCreationTime.dwHighDateTime=0x1d4d167, ftLastAccessTime.dwLowDateTime=0x21657950, ftLastAccessTime.dwHighDateTime=0x1d4c726, ftLastWriteTime.dwLowDateTime=0x21657950, ftLastWriteTime.dwHighDateTime=0x1d4c726, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0055.784] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.784] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.784] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.784] lstrcmpW (lpString1="E8Z5TJoPLK1iy6", lpString2="..") returned 1 [0055.784] lstrcmpW (lpString1="E8Z5TJoPLK1iy6", lpString2=".") returned 1 [0055.784] GetProcessHeap () returned 0x1130000 [0055.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f401f8 [0055.785] lstrcpyW (in: lpString1=0x3f401f8, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6" [0055.785] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 139 [0055.785] QueueUserWorkItem (Function=0x129a680, Context=0x3f401f8, Flags=0x0) returned 1 [0055.785] GetProcessHeap () returned 0x1130000 [0055.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f50200 [0055.786] wnsprintfW (in: pszDest=0x3f50200, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\*") returned 98 [0055.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\*", lpFindFileData=0xeeea88 | out: lpFindFileData=0xeeea88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60f13370, ftCreationTime.dwHighDateTime=0x1d4cd43, ftLastAccessTime.dwLowDateTime=0x621bec70, ftLastAccessTime.dwHighDateTime=0x1d4c890, ftLastWriteTime.dwLowDateTime=0x621bec70, ftLastWriteTime.dwHighDateTime=0x1d4c890, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0055.786] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.786] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.786] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.786] lstrcmpW (lpString1="aKjOckxU5PAtg9", lpString2="..") returned 1 [0055.786] lstrcmpW (lpString1="aKjOckxU5PAtg9", lpString2=".") returned 1 [0055.786] GetProcessHeap () returned 0x1130000 [0055.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f60208 [0055.787] lstrcpyW (in: lpString1=0x3f60208, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9" [0055.787] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 140 [0055.787] QueueUserWorkItem (Function=0x129a680, Context=0x3f60208, Flags=0x0) returned 1 [0055.787] GetProcessHeap () returned 0x1130000 [0055.787] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70210 [0055.788] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\*") returned 113 [0055.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\*", lpFindFileData=0xeee810 | out: lpFindFileData=0xeee810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5cb966d0, ftCreationTime.dwHighDateTime=0x1d4c698, ftLastAccessTime.dwLowDateTime=0x4da98380, ftLastAccessTime.dwHighDateTime=0x1d4c82f, ftLastWriteTime.dwLowDateTime=0x4da98380, ftLastWriteTime.dwHighDateTime=0x1d4c82f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c60 [0055.789] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.789] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.789] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.789] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.789] WriteFile (in: hFile=0x3c4, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeea74, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeea74*=0x9d7, lpOverlapped=0x0) returned 1 [0055.790] CloseHandle (hObject=0x3c4) returned 1 [0055.790] GetProcessHeap () returned 0x1130000 [0055.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70210 | out: hHeap=0x1130000) returned 1 [0055.791] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.791] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeecec, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeecec*=0x9d7, lpOverlapped=0x0) returned 1 [0055.792] CloseHandle (hObject=0x3b0) returned 1 [0055.792] GetProcessHeap () returned 0x1130000 [0055.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f50200 | out: hHeap=0x1130000) returned 1 [0055.792] lstrcmpW (lpString1="n_ilhG4PKt 7Fb", lpString2="..") returned 1 [0055.792] lstrcmpW (lpString1="n_ilhG4PKt 7Fb", lpString2=".") returned 1 [0055.792] GetProcessHeap () returned 0x1130000 [0055.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f50200 [0055.792] lstrcpyW (in: lpString1=0x3f50200, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb" [0055.792] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 141 [0055.792] QueueUserWorkItem (Function=0x129a680, Context=0x3f50200, Flags=0x0) returned 1 [0055.792] GetProcessHeap () returned 0x1130000 [0055.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70210 [0055.792] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\*") returned 98 [0055.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\*", lpFindFileData=0xeeea88 | out: lpFindFileData=0xeeea88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b9daea0, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x4358d210, ftLastAccessTime.dwHighDateTime=0x1d4d22e, ftLastWriteTime.dwLowDateTime=0x4358d210, ftLastWriteTime.dwHighDateTime=0x1d4d22e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0055.793] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.793] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.793] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.793] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.793] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeecec, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeecec*=0x9d7, lpOverlapped=0x0) returned 1 [0055.794] CloseHandle (hObject=0x3b0) returned 1 [0055.794] GetProcessHeap () returned 0x1130000 [0055.794] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70210 | out: hHeap=0x1130000) returned 1 [0055.794] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.794] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeef64, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeef64*=0x9d7, lpOverlapped=0x0) returned 1 [0055.795] CloseHandle (hObject=0x3bc) returned 1 [0055.795] GetProcessHeap () returned 0x1130000 [0055.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f301f0 | out: hHeap=0x1130000) returned 1 [0055.795] lstrcmpW (lpString1="UHrn6B3UOTpcahw4qo", lpString2="..") returned 1 [0055.795] lstrcmpW (lpString1="UHrn6B3UOTpcahw4qo", lpString2=".") returned 1 [0055.795] GetProcessHeap () returned 0x1130000 [0055.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f301f0 [0055.795] lstrcpyW (in: lpString1=0x3f301f0, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo" [0055.795] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 142 [0055.795] QueueUserWorkItem (Function=0x129a680, Context=0x3f301f0, Flags=0x0) returned 1 [0055.795] GetProcessHeap () returned 0x1130000 [0055.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70210 [0055.795] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\*") returned 87 [0055.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\*", lpFindFileData=0xeeed00 | out: lpFindFileData=0xeeed00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0c2560, ftCreationTime.dwHighDateTime=0x1d4cbf4, ftLastAccessTime.dwLowDateTime=0xcc948ac0, ftLastAccessTime.dwHighDateTime=0x1d4d25f, ftLastWriteTime.dwLowDateTime=0xcc948ac0, ftLastWriteTime.dwHighDateTime=0x1d4d25f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0055.795] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.795] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.796] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.796] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.796] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeef64, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeef64*=0x9d7, lpOverlapped=0x0) returned 1 [0055.797] CloseHandle (hObject=0x3bc) returned 1 [0055.797] GetProcessHeap () returned 0x1130000 [0055.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70210 | out: hHeap=0x1130000) returned 1 [0055.870] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.870] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef1dc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef1dc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.871] CloseHandle (hObject=0x3bc) returned 1 [0055.871] GetProcessHeap () returned 0x1130000 [0055.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f101e0 | out: hHeap=0x1130000) returned 1 [0055.871] lstrcmpW (lpString1="XfTxZ5k", lpString2="..") returned 1 [0055.871] lstrcmpW (lpString1="XfTxZ5k", lpString2=".") returned 1 [0055.871] GetProcessHeap () returned 0x1130000 [0055.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f101e0 [0055.871] lstrcpyW (in: lpString1=0x3f101e0, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k" [0055.871] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 143 [0055.871] QueueUserWorkItem (Function=0x129a680, Context=0x3f101e0, Flags=0x0) returned 1 [0055.871] GetProcessHeap () returned 0x1130000 [0055.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70210 [0055.871] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\*") returned 55 [0055.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\*", lpFindFileData=0xeeef78 | out: lpFindFileData=0xeeef78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3f6d860, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x504a5750, ftLastAccessTime.dwHighDateTime=0x1d4cbb7, ftLastWriteTime.dwLowDateTime=0x504a5750, ftLastWriteTime.dwHighDateTime=0x1d4cbb7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c60 [0055.872] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.872] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.872] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.872] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.872] WriteFile (in: hFile=0x3bc, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef1dc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef1dc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.873] CloseHandle (hObject=0x3bc) returned 1 [0055.873] GetProcessHeap () returned 0x1130000 [0055.873] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70210 | out: hHeap=0x1130000) returned 1 [0055.873] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.873] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.874] CloseHandle (hObject=0x3c0) returned 1 [0055.874] GetProcessHeap () returned 0x1130000 [0055.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ef01d0 | out: hHeap=0x1130000) returned 1 [0055.874] lstrcmpW (lpString1="5j6qS2RSr", lpString2="..") returned 1 [0055.874] lstrcmpW (lpString1="5j6qS2RSr", lpString2=".") returned 1 [0055.874] GetProcessHeap () returned 0x1130000 [0055.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ef01d0 [0055.874] lstrcpyW (in: lpString1=0x3ef01d0, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr") returned="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr" [0055.874] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 144 [0055.874] QueueUserWorkItem (Function=0x129a680, Context=0x3ef01d0, Flags=0x0) returned 1 [0055.874] GetProcessHeap () returned 0x1130000 [0055.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70210 [0055.874] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\*") returned 37 [0055.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7949f0, ftCreationTime.dwHighDateTime=0x1d4d204, ftLastAccessTime.dwLowDateTime=0x6b921600, ftLastAccessTime.dwHighDateTime=0x1d4c5dc, ftLastWriteTime.dwLowDateTime=0x6b921600, ftLastWriteTime.dwHighDateTime=0x1d4c5dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.874] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.874] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.875] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.875] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.875] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.876] CloseHandle (hObject=0x3c0) returned 1 [0055.876] GetProcessHeap () returned 0x1130000 [0055.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70210 | out: hHeap=0x1130000) returned 1 [0055.876] GetProcessHeap () returned 0x1130000 [0055.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ed01c0 | out: hHeap=0x1130000) returned 1 [0055.876] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0055.876] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0055.876] GetProcessHeap () returned 0x1130000 [0055.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ed01c0 [0055.876] lstrcpyW (in: lpString1=0x3ed01c0, lpString2="\\\\?\\C:\\Users\\FD1HVy\\My Documents" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\My Documents") returned="\\\\?\\C:\\Users\\FD1HVy\\My Documents" [0055.876] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 145 [0055.876] QueueUserWorkItem (Function=0x129a680, Context=0x3ed01c0, Flags=0x0) returned 1 [0055.876] GetProcessHeap () returned 0x1130000 [0055.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70210 [0055.876] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\My Documents\\*") returned 34 [0055.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6169a0, ftCreationTime.dwHighDateTime=0x1d4c90a, ftLastAccessTime.dwLowDateTime=0x7efb2160, ftLastAccessTime.dwHighDateTime=0x1d4cc34, ftLastWriteTime.dwLowDateTime=0x7efb2160, ftLastWriteTime.dwHighDateTime=0x1d4cc34, nFileSizeHigh=0x0, nFileSizeLow=0x14253, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.876] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\My Documents\\read_me.txt") returned 44 [0055.876] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\My Documents\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\my documents\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.877] GetProcessHeap () returned 0x1130000 [0055.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70210 | out: hHeap=0x1130000) returned 1 [0055.877] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0055.877] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0055.877] GetProcessHeap () returned 0x1130000 [0055.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70210 [0055.877] lstrcpyW (in: lpString1=0x3f70210, lpString2="\\\\?\\C:\\Users\\FD1HVy\\NetHood" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\NetHood") returned="\\\\?\\C:\\Users\\FD1HVy\\NetHood" [0055.877] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 146 [0055.877] QueueUserWorkItem (Function=0x129a680, Context=0x3f70210, Flags=0x0) returned 1 [0055.877] GetProcessHeap () returned 0x1130000 [0055.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3870090 [0055.877] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NetHood\\*") returned 29 [0055.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6169a0, ftCreationTime.dwHighDateTime=0x1d4c90a, ftLastAccessTime.dwLowDateTime=0x7efb2160, ftLastAccessTime.dwHighDateTime=0x1d4cc34, ftLastWriteTime.dwLowDateTime=0x7efb2160, ftLastWriteTime.dwHighDateTime=0x1d4cc34, nFileSizeHigh=0x0, nFileSizeLow=0x14253, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.877] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NetHood\\read_me.txt") returned 39 [0055.877] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\NetHood\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\nethood\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.878] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.878] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.879] CloseHandle (hObject=0x3b8) returned 1 [0055.879] GetProcessHeap () returned 0x1130000 [0055.879] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3870090 | out: hHeap=0x1130000) returned 1 [0055.879] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0055.879] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0055.879] GetProcessHeap () returned 0x1130000 [0055.879] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3870090 [0055.879] lstrcpyW (in: lpString1=0x3870090, lpString2="\\\\?\\C:\\Users\\FD1HVy\\OneDrive" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\OneDrive") returned="\\\\?\\C:\\Users\\FD1HVy\\OneDrive" [0055.879] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 147 [0055.879] QueueUserWorkItem (Function=0x129a680, Context=0x3870090, Flags=0x0) returned 1 [0055.879] GetProcessHeap () returned 0x1130000 [0055.879] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0055.879] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\OneDrive\\*") returned 30 [0055.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.880] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.880] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.880] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.880] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.880] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.881] CloseHandle (hObject=0x3b8) returned 1 [0055.881] GetProcessHeap () returned 0x1130000 [0055.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0055.881] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0055.881] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0055.881] GetProcessHeap () returned 0x1130000 [0055.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0055.881] lstrcpyW (in: lpString1=0x3880098, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Pictures" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Pictures") returned="\\\\?\\C:\\Users\\FD1HVy\\Pictures" [0055.881] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 148 [0055.881] QueueUserWorkItem (Function=0x129a680, Context=0x3880098, Flags=0x0) returned 1 [0055.881] GetProcessHeap () returned 0x1130000 [0055.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0055.881] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\*") returned 30 [0055.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd592a8d7, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d5efd9, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.881] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.882] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.882] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.882] lstrcmpW (lpString1="Camera Roll", lpString2="..") returned 1 [0055.882] lstrcmpW (lpString1="Camera Roll", lpString2=".") returned 1 [0055.882] GetProcessHeap () returned 0x1130000 [0055.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3650080 [0055.882] lstrcpyW (in: lpString1=0x3650080, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0055.882] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 149 [0055.882] QueueUserWorkItem (Function=0x129a680, Context=0x3650080, Flags=0x0) returned 1 [0055.882] GetProcessHeap () returned 0x1130000 [0055.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3660088 [0055.882] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*") returned 42 [0055.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.883] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.883] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.883] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.883] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.883] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.884] CloseHandle (hObject=0x3c0) returned 1 [0055.884] GetProcessHeap () returned 0x1130000 [0055.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3660088 | out: hHeap=0x1130000) returned 1 [0055.884] lstrcmpW (lpString1="Saved Pictures", lpString2="..") returned 1 [0055.884] lstrcmpW (lpString1="Saved Pictures", lpString2=".") returned 1 [0055.884] GetProcessHeap () returned 0x1130000 [0055.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3660088 [0055.884] lstrcpyW (in: lpString1=0x3660088, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0055.884] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 150 [0055.884] QueueUserWorkItem (Function=0x129a680, Context=0x3660088, Flags=0x0) returned 1 [0055.884] GetProcessHeap () returned 0x1130000 [0055.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f81220 [0055.886] wnsprintfW (in: pszDest=0x3f81220, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*") returned 45 [0055.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.886] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.886] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.886] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.887] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.887] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0055.888] CloseHandle (hObject=0x3c0) returned 1 [0055.888] GetProcessHeap () returned 0x1130000 [0055.888] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f81220 | out: hHeap=0x1130000) returned 1 [0055.888] GetProcessHeap () returned 0x1130000 [0055.888] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0055.888] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0055.888] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0055.888] GetProcessHeap () returned 0x1130000 [0055.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0055.888] lstrcpyW (in: lpString1=0x3640078, lpString2="\\\\?\\C:\\Users\\FD1HVy\\PrintHood" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\PrintHood") returned="\\\\?\\C:\\Users\\FD1HVy\\PrintHood" [0055.888] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 151 [0055.888] QueueUserWorkItem (Function=0x129a680, Context=0x3640078, Flags=0x0) returned 1 [0055.888] GetProcessHeap () returned 0x1130000 [0055.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f81220 [0055.888] wnsprintfW (in: pszDest=0x3f81220, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\PrintHood\\*") returned 31 [0055.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56728290, ftCreationTime.dwHighDateTime=0x1d4cc1d, ftLastAccessTime.dwLowDateTime=0xc933fc80, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0xc933fc80, ftLastWriteTime.dwHighDateTime=0x1d4ceef, nFileSizeHigh=0x0, nFileSizeLow=0x89e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.889] wnsprintfW (in: pszDest=0x3f81220, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\PrintHood\\read_me.txt") returned 41 [0055.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\PrintHood\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\printhood\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.889] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.889] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.890] CloseHandle (hObject=0x3b8) returned 1 [0055.890] GetProcessHeap () returned 0x1130000 [0055.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f81220 | out: hHeap=0x1130000) returned 1 [0055.890] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0055.890] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0055.890] GetProcessHeap () returned 0x1130000 [0055.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f81220 [0055.890] lstrcpyW (in: lpString1=0x3f81220, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Recent" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Recent") returned="\\\\?\\C:\\Users\\FD1HVy\\Recent" [0055.890] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 152 [0055.890] QueueUserWorkItem (Function=0x129a680, Context=0x3f81220, Flags=0x0) returned 1 [0055.890] GetProcessHeap () returned 0x1130000 [0055.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f91228 [0055.891] wnsprintfW (in: pszDest=0x3f91228, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Recent\\*") returned 28 [0055.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56728290, ftCreationTime.dwHighDateTime=0x1d4cc1d, ftLastAccessTime.dwLowDateTime=0xc933fc80, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0xc933fc80, ftLastWriteTime.dwHighDateTime=0x1d4ceef, nFileSizeHigh=0x0, nFileSizeLow=0x89e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.892] wnsprintfW (in: pszDest=0x3f91228, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Recent\\read_me.txt") returned 38 [0055.892] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Recent\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\recent\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.892] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.892] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.893] CloseHandle (hObject=0x3b8) returned 1 [0055.893] GetProcessHeap () returned 0x1130000 [0055.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f91228 | out: hHeap=0x1130000) returned 1 [0055.893] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0055.893] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0055.893] GetProcessHeap () returned 0x1130000 [0055.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f91228 [0055.893] lstrcpyW (in: lpString1=0x3f91228, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Saved Games" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Saved Games") returned="\\\\?\\C:\\Users\\FD1HVy\\Saved Games" [0055.893] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 153 [0055.893] QueueUserWorkItem (Function=0x129a680, Context=0x3f91228, Flags=0x0) returned 1 [0055.893] GetProcessHeap () returned 0x1130000 [0055.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fa1230 [0055.894] wnsprintfW (in: pszDest=0x3fa1230, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Saved Games\\*") returned 33 [0055.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.894] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.894] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.894] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.895] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.895] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.896] CloseHandle (hObject=0x3b8) returned 1 [0055.896] GetProcessHeap () returned 0x1130000 [0055.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fa1230 | out: hHeap=0x1130000) returned 1 [0055.896] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0055.896] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0055.896] GetProcessHeap () returned 0x1130000 [0055.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fa1230 [0055.896] lstrcpyW (in: lpString1=0x3fa1230, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Searches" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Searches") returned="\\\\?\\C:\\Users\\FD1HVy\\Searches" [0055.896] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 154 [0055.896] QueueUserWorkItem (Function=0x129a680, Context=0x3fa1230, Flags=0x0) returned 1 [0055.897] GetProcessHeap () returned 0x1130000 [0055.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fb1238 [0055.897] wnsprintfW (in: pszDest=0x3fb1238, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Searches\\*") returned 30 [0055.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.898] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.898] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.898] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.898] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.898] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.899] CloseHandle (hObject=0x3b8) returned 1 [0055.899] GetProcessHeap () returned 0x1130000 [0055.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fb1238 | out: hHeap=0x1130000) returned 1 [0055.899] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0055.899] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0055.899] GetProcessHeap () returned 0x1130000 [0055.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fb1238 [0055.899] lstrcpyW (in: lpString1=0x3fb1238, lpString2="\\\\?\\C:\\Users\\FD1HVy\\SendTo" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\SendTo") returned="\\\\?\\C:\\Users\\FD1HVy\\SendTo" [0055.899] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 155 [0055.899] QueueUserWorkItem (Function=0x129a680, Context=0x3fb1238, Flags=0x0) returned 1 [0055.899] GetProcessHeap () returned 0x1130000 [0055.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fc1240 [0055.900] wnsprintfW (in: pszDest=0x3fc1240, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\SendTo\\*") returned 28 [0055.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0055.900] wnsprintfW (in: pszDest=0x3fc1240, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\SendTo\\read_me.txt") returned 38 [0055.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\SendTo\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\sendto\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.905] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.905] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.906] CloseHandle (hObject=0x3b8) returned 1 [0055.906] GetProcessHeap () returned 0x1130000 [0055.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fc1240 | out: hHeap=0x1130000) returned 1 [0055.906] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0055.906] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0055.906] GetProcessHeap () returned 0x1130000 [0055.906] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fc1240 [0055.906] lstrcpyW (in: lpString1=0x3fc1240, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Start Menu" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Start Menu") returned="\\\\?\\C:\\Users\\FD1HVy\\Start Menu" [0055.906] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 156 [0055.906] QueueUserWorkItem (Function=0x129a680, Context=0x3fc1240, Flags=0x0) returned 1 [0055.906] GetProcessHeap () returned 0x1130000 [0055.906] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fe0048 [0055.908] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Start Menu\\*") returned 32 [0055.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.908] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Start Menu\\read_me.txt") returned 42 [0055.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Start Menu\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\start menu\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.908] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.908] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.909] CloseHandle (hObject=0x3b8) returned 1 [0055.909] GetProcessHeap () returned 0x1130000 [0055.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0055.909] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0055.909] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0055.909] GetProcessHeap () returned 0x1130000 [0055.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fe0048 [0055.909] lstrcpyW (in: lpString1=0x3fe0048, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Templates" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Templates") returned="\\\\?\\C:\\Users\\FD1HVy\\Templates" [0055.909] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 157 [0055.909] QueueUserWorkItem (Function=0x129a680, Context=0x3fe0048, Flags=0x0) returned 1 [0055.909] GetProcessHeap () returned 0x1130000 [0055.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ff0050 [0055.910] wnsprintfW (in: pszDest=0x3ff0050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Templates\\*") returned 31 [0055.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="")) returned 0xffffffff [0055.911] wnsprintfW (in: pszDest=0x3ff0050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Templates\\read_me.txt") returned 41 [0055.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Templates\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\templates\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0055.912] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0055.912] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0055.912] CloseHandle (hObject=0x3b8) returned 1 [0055.913] GetProcessHeap () returned 0x1130000 [0055.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ff0050 | out: hHeap=0x1130000) returned 1 [0055.913] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0055.913] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0055.913] GetProcessHeap () returned 0x1130000 [0055.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ff0050 [0055.913] lstrcpyW (in: lpString1=0x3ff0050, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Videos" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Videos") returned="\\\\?\\C:\\Users\\FD1HVy\\Videos" [0055.913] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 158 [0055.913] QueueUserWorkItem (Function=0x129a680, Context=0x3ff0050, Flags=0x0) returned 1 [0055.913] GetProcessHeap () returned 0x1130000 [0055.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0055.914] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\*") returned 28 [0055.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd5891f55, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.914] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.914] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.914] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.914] lstrcmpW (lpString1="x89rl", lpString2="..") returned 1 [0055.914] lstrcmpW (lpString1="x89rl", lpString2=".") returned 1 [0055.914] GetProcessHeap () returned 0x1130000 [0055.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4010060 [0055.915] lstrcpyW (in: lpString1=0x4010060, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl") returned="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl" [0055.915] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 159 [0055.915] QueueUserWorkItem (Function=0x129a680, Context=0x4010060, Flags=0x0) returned 1 [0055.915] GetProcessHeap () returned 0x1130000 [0055.915] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4020068 [0055.916] wnsprintfW (in: pszDest=0x4020068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\*") returned 34 [0055.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b5386c0, ftCreationTime.dwHighDateTime=0x1d4cd04, ftLastAccessTime.dwLowDateTime=0xb307ce70, ftLastAccessTime.dwHighDateTime=0x1d4ceb6, ftLastWriteTime.dwLowDateTime=0xb307ce70, ftLastWriteTime.dwHighDateTime=0x1d4ceb6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0055.916] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.916] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.957] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.957] lstrcmpW (lpString1="jpvh", lpString2="..") returned 1 [0055.957] lstrcmpW (lpString1="jpvh", lpString2=".") returned 1 [0055.957] GetProcessHeap () returned 0x1130000 [0055.957] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4030070 [0055.958] lstrcpyW (in: lpString1=0x4030070, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh") returned="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh" [0055.958] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 160 [0055.958] QueueUserWorkItem (Function=0x129a680, Context=0x4030070, Flags=0x0) returned 1 [0055.958] GetProcessHeap () returned 0x1130000 [0055.958] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4040078 [0055.959] wnsprintfW (in: pszDest=0x4040078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\*") returned 39 [0055.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\*", lpFindFileData=0xeeef78 | out: lpFindFileData=0xeeef78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a7d5690, ftCreationTime.dwHighDateTime=0x1d4c7f1, ftLastAccessTime.dwLowDateTime=0xf36658e0, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0xf36658e0, ftLastWriteTime.dwHighDateTime=0x1d4d165, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0055.959] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.959] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.959] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.959] lstrcmpW (lpString1="PZ4ukYICvjeTK9jR", lpString2="..") returned 1 [0055.960] lstrcmpW (lpString1="PZ4ukYICvjeTK9jR", lpString2=".") returned 1 [0055.960] GetProcessHeap () returned 0x1130000 [0055.960] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4050080 [0055.960] lstrcpyW (in: lpString1=0x4050080, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR") returned="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR" [0055.960] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 161 [0055.960] QueueUserWorkItem (Function=0x129a680, Context=0x4050080, Flags=0x0) returned 1 [0055.960] GetProcessHeap () returned 0x1130000 [0055.960] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4060088 [0055.961] wnsprintfW (in: pszDest=0x4060088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\*") returned 56 [0055.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\*", lpFindFileData=0xeeed00 | out: lpFindFileData=0xeeed00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a296ef0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0x1e781aa0, ftLastAccessTime.dwHighDateTime=0x1d4c6a8, ftLastWriteTime.dwLowDateTime=0x1e781aa0, ftLastWriteTime.dwHighDateTime=0x1d4c6a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0055.962] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0055.962] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.962] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.962] lstrcmpW (lpString1="xHSTZp32BgqiA7f", lpString2="..") returned 1 [0055.962] lstrcmpW (lpString1="xHSTZp32BgqiA7f", lpString2=".") returned 1 [0055.962] GetProcessHeap () returned 0x1130000 [0055.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0055.963] lstrcpyW (in: lpString1=0x4070090, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f") returned="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f" [0055.963] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 162 [0055.963] QueueUserWorkItem (Function=0x129a680, Context=0x4070090, Flags=0x0) returned 1 [0055.963] GetProcessHeap () returned 0x1130000 [0055.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4080098 [0056.024] wnsprintfW (in: pszDest=0x4080098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\*") returned 72 [0056.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\*", lpFindFileData=0xeeea88 | out: lpFindFileData=0xeeea88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e70580, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xb93b2330, ftLastAccessTime.dwHighDateTime=0x1d4d480, ftLastWriteTime.dwLowDateTime=0xb93b2330, ftLastWriteTime.dwHighDateTime=0x1d4d480, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170c60 [0056.057] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.057] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.058] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.058] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeecec, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeecec*=0x9d7, lpOverlapped=0x0) returned 1 [0056.059] CloseHandle (hObject=0x3b8) returned 1 [0056.059] GetProcessHeap () returned 0x1130000 [0056.059] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4080098 | out: hHeap=0x1130000) returned 1 [0056.059] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.059] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeeef64, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeeef64*=0x9d7, lpOverlapped=0x0) returned 1 [0056.060] CloseHandle (hObject=0x3b0) returned 1 [0056.060] GetProcessHeap () returned 0x1130000 [0056.060] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4060088 | out: hHeap=0x1130000) returned 1 [0056.060] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.060] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef1dc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef1dc*=0x9d7, lpOverlapped=0x0) returned 1 [0056.061] CloseHandle (hObject=0x3b0) returned 1 [0056.061] GetProcessHeap () returned 0x1130000 [0056.061] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4040078 | out: hHeap=0x1130000) returned 1 [0056.062] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.062] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0056.063] CloseHandle (hObject=0x3c0) returned 1 [0056.063] GetProcessHeap () returned 0x1130000 [0056.063] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4020068 | out: hHeap=0x1130000) returned 1 [0056.063] lstrcmpW (lpString1="Y00L86e893nr", lpString2="..") returned 1 [0056.063] lstrcmpW (lpString1="Y00L86e893nr", lpString2=".") returned 1 [0056.063] GetProcessHeap () returned 0x1130000 [0056.063] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4020068 [0056.063] lstrcpyW (in: lpString1=0x4020068, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr") returned="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr" [0056.064] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 163 [0056.064] QueueUserWorkItem (Function=0x129a680, Context=0x4020068, Flags=0x0) returned 1 [0056.064] GetProcessHeap () returned 0x1130000 [0056.064] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4040078 [0056.064] wnsprintfW (in: pszDest=0x4040078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\*") returned 41 [0056.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7398ab0, ftCreationTime.dwHighDateTime=0x1d4cc66, ftLastAccessTime.dwLowDateTime=0xa22575c0, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0xa22575c0, ftLastWriteTime.dwHighDateTime=0x1d4ca52, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.064] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.064] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.064] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.064] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.064] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0056.065] CloseHandle (hObject=0x3c0) returned 1 [0056.065] GetProcessHeap () returned 0x1130000 [0056.065] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4040078 | out: hHeap=0x1130000) returned 1 [0056.065] lstrcmpW (lpString1="YcteYZ3k e_kH_NYjCi", lpString2="..") returned 1 [0056.065] lstrcmpW (lpString1="YcteYZ3k e_kH_NYjCi", lpString2=".") returned 1 [0056.065] GetProcessHeap () returned 0x1130000 [0056.065] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4040078 [0056.065] lstrcpyW (in: lpString1=0x4040078, lpString2="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi" | out: lpString1="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi") returned="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi" [0056.065] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 164 [0056.065] QueueUserWorkItem (Function=0x129a680, Context=0x4040078, Flags=0x0) returned 1 [0056.065] GetProcessHeap () returned 0x1130000 [0056.065] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4060088 [0056.065] wnsprintfW (in: pszDest=0x4060088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\*") returned 48 [0056.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825881f0, ftCreationTime.dwHighDateTime=0x1d4c7ba, ftLastAccessTime.dwLowDateTime=0x835da5c0, ftLastAccessTime.dwHighDateTime=0x1d4cfe5, ftLastWriteTime.dwLowDateTime=0x835da5c0, ftLastWriteTime.dwHighDateTime=0x1d4cfe5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.065] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.066] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.066] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.066] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.066] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0056.067] CloseHandle (hObject=0x3c0) returned 1 [0056.067] GetProcessHeap () returned 0x1130000 [0056.067] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4060088 | out: hHeap=0x1130000) returned 1 [0056.067] GetProcessHeap () returned 0x1130000 [0056.067] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.067] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.067] WriteFile (in: hFile=0x3c0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0056.068] CloseHandle (hObject=0x3c0) returned 1 [0056.068] GetProcessHeap () returned 0x1130000 [0056.068] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d100e0 | out: hHeap=0x1130000) returned 1 [0056.068] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0056.068] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0056.068] GetProcessHeap () returned 0x1130000 [0056.068] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d100e0 [0056.068] lstrcpyW (in: lpString1=0x3d100e0, lpString2="\\\\?\\C:\\Users\\Public" | out: lpString1="\\\\?\\C:\\Users\\Public") returned="\\\\?\\C:\\Users\\Public" [0056.068] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 165 [0056.068] QueueUserWorkItem (Function=0x129a680, Context=0x3d100e0, Flags=0x0) returned 1 [0056.068] GetProcessHeap () returned 0x1130000 [0056.068] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.068] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\*") returned 21 [0056.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\*", lpFindFileData=0xeef6e0 | out: lpFindFileData=0xeef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.069] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.069] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.069] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.069] lstrcmpW (lpString1="AccountPictures", lpString2="..") returned 1 [0056.069] lstrcmpW (lpString1="AccountPictures", lpString2=".") returned 1 [0056.069] GetProcessHeap () returned 0x1130000 [0056.069] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4060088 [0056.069] lstrcpyW (in: lpString1=0x4060088, lpString2="\\\\?\\C:\\Users\\Public\\AccountPictures" | out: lpString1="\\\\?\\C:\\Users\\Public\\AccountPictures") returned="\\\\?\\C:\\Users\\Public\\AccountPictures" [0056.069] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 166 [0056.069] QueueUserWorkItem (Function=0x129a680, Context=0x4060088, Flags=0x0) returned 1 [0056.069] GetProcessHeap () returned 0x1130000 [0056.069] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3670090 [0056.069] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\AccountPictures\\*") returned 37 [0056.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.069] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.069] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.069] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.070] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.070] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0056.071] CloseHandle (hObject=0x3b0) returned 1 [0056.071] GetProcessHeap () returned 0x1130000 [0056.071] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3670090 | out: hHeap=0x1130000) returned 1 [0056.071] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0056.072] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0056.072] GetProcessHeap () returned 0x1130000 [0056.072] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3670090 [0056.072] lstrcpyW (in: lpString1=0x3670090, lpString2="\\\\?\\C:\\Users\\Public\\Desktop" | out: lpString1="\\\\?\\C:\\Users\\Public\\Desktop") returned="\\\\?\\C:\\Users\\Public\\Desktop" [0056.072] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 167 [0056.072] QueueUserWorkItem (Function=0x129a680, Context=0x3670090, Flags=0x0) returned 1 [0056.072] GetProcessHeap () returned 0x1130000 [0056.072] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0056.072] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\*") returned 29 [0056.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.072] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.072] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.072] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.073] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.073] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0056.074] CloseHandle (hObject=0x3b0) returned 1 [0056.074] GetProcessHeap () returned 0x1130000 [0056.074] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0056.074] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0056.074] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0056.074] GetProcessHeap () returned 0x1130000 [0056.074] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0056.074] lstrcpyW (in: lpString1=0x120dfc8, lpString2="\\\\?\\C:\\Users\\Public\\Documents" | out: lpString1="\\\\?\\C:\\Users\\Public\\Documents") returned="\\\\?\\C:\\Users\\Public\\Documents" [0056.074] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 168 [0056.074] QueueUserWorkItem (Function=0x129a680, Context=0x120dfc8, Flags=0x0) returned 1 [0056.074] GetProcessHeap () returned 0x1130000 [0056.074] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4080098 [0056.074] wnsprintfW (in: pszDest=0x4080098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\*") returned 31 [0056.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.076] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.076] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.076] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.076] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0056.076] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0056.076] GetProcessHeap () returned 0x1130000 [0056.076] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40900a0 [0056.077] lstrcpyW (in: lpString1=0x40900a0, lpString2="\\\\?\\C:\\Users\\Public\\Documents\\My Music" | out: lpString1="\\\\?\\C:\\Users\\Public\\Documents\\My Music") returned="\\\\?\\C:\\Users\\Public\\Documents\\My Music" [0056.077] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 169 [0056.077] QueueUserWorkItem (Function=0x129a680, Context=0x40900a0, Flags=0x0) returned 1 [0056.077] GetProcessHeap () returned 0x1130000 [0056.077] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40a00a8 [0056.078] wnsprintfW (in: pszDest=0x40a00a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\*") returned 40 [0056.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0056.078] wnsprintfW (in: pszDest=0x40a00a8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\read_me.txt") returned 50 [0056.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\read_me.txt" (normalized: "c:\\users\\public\\documents\\my music\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0056.079] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.079] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0056.079] CloseHandle (hObject=0x3b8) returned 1 [0056.080] GetProcessHeap () returned 0x1130000 [0056.080] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40a00a8 | out: hHeap=0x1130000) returned 1 [0056.080] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0056.080] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0056.080] GetProcessHeap () returned 0x1130000 [0056.080] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40a00a8 [0056.080] lstrcpyW (in: lpString1=0x40a00a8, lpString2="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures") returned="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures" [0056.080] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 170 [0056.080] QueueUserWorkItem (Function=0x129a680, Context=0x40a00a8, Flags=0x0) returned 1 [0056.080] GetProcessHeap () returned 0x1130000 [0056.080] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40b00b0 [0056.081] wnsprintfW (in: pszDest=0x40b00b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\*") returned 43 [0056.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0056.081] wnsprintfW (in: pszDest=0x40b00b0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\read_me.txt") returned 53 [0056.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\read_me.txt" (normalized: "c:\\users\\public\\documents\\my pictures\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0056.081] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.081] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0056.082] CloseHandle (hObject=0x3b8) returned 1 [0056.082] GetProcessHeap () returned 0x1130000 [0056.082] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40b00b0 | out: hHeap=0x1130000) returned 1 [0056.082] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0056.082] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0056.082] GetProcessHeap () returned 0x1130000 [0056.082] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40b00b0 [0056.082] lstrcpyW (in: lpString1=0x40b00b0, lpString2="\\\\?\\C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="\\\\?\\C:\\Users\\Public\\Documents\\My Videos") returned="\\\\?\\C:\\Users\\Public\\Documents\\My Videos" [0056.082] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 171 [0056.082] QueueUserWorkItem (Function=0x129a680, Context=0x40b00b0, Flags=0x0) returned 1 [0056.082] GetProcessHeap () returned 0x1130000 [0056.082] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40c00b8 [0056.083] wnsprintfW (in: pszDest=0x40c00b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\*") returned 41 [0056.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0xeef1f0 | out: lpFindFileData=0xeef1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName="\x01", cAlternateFileName="㴂ᦱî縼瓶îa")) returned 0xffffffff [0056.083] wnsprintfW (in: pszDest=0x40c00b8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\read_me.txt") returned 51 [0056.084] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\read_me.txt" (normalized: "c:\\users\\public\\documents\\my videos\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0056.084] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.084] WriteFile (in: hFile=0x3b8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef454, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef454*=0x9d7, lpOverlapped=0x0) returned 1 [0056.085] CloseHandle (hObject=0x3b8) returned 1 [0056.085] GetProcessHeap () returned 0x1130000 [0056.085] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40c00b8 | out: hHeap=0x1130000) returned 1 [0056.087] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.087] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0056.088] CloseHandle (hObject=0x3b0) returned 1 [0056.088] GetProcessHeap () returned 0x1130000 [0056.088] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4080098 | out: hHeap=0x1130000) returned 1 [0056.088] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0056.088] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0056.088] GetProcessHeap () returned 0x1130000 [0056.088] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4080098 [0056.088] lstrcpyW (in: lpString1=0x4080098, lpString2="\\\\?\\C:\\Users\\Public\\Downloads" | out: lpString1="\\\\?\\C:\\Users\\Public\\Downloads") returned="\\\\?\\C:\\Users\\Public\\Downloads" [0056.088] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 172 [0056.088] QueueUserWorkItem (Function=0x129a680, Context=0x4080098, Flags=0x0) returned 1 [0056.088] GetProcessHeap () returned 0x1130000 [0056.088] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40c00b8 [0056.088] wnsprintfW (in: pszDest=0x40c00b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Downloads\\*") returned 31 [0056.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.089] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.089] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.089] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.089] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.089] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0056.090] CloseHandle (hObject=0x3b0) returned 1 [0056.090] GetProcessHeap () returned 0x1130000 [0056.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40c00b8 | out: hHeap=0x1130000) returned 1 [0056.090] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0056.090] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0056.090] GetProcessHeap () returned 0x1130000 [0056.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40c00b8 [0056.090] lstrcpyW (in: lpString1=0x40c00b8, lpString2="\\\\?\\C:\\Users\\Public\\Libraries" | out: lpString1="\\\\?\\C:\\Users\\Public\\Libraries") returned="\\\\?\\C:\\Users\\Public\\Libraries" [0056.090] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 173 [0056.090] QueueUserWorkItem (Function=0x129a680, Context=0x40c00b8, Flags=0x0) returned 1 [0056.090] GetProcessHeap () returned 0x1130000 [0056.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40d00c0 [0056.091] wnsprintfW (in: pszDest=0x40d00c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Libraries\\*") returned 31 [0056.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.091] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.091] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.091] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.091] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.091] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef6cc, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef6cc*=0x9d7, lpOverlapped=0x0) returned 1 [0056.092] CloseHandle (hObject=0x3b0) returned 1 [0056.092] GetProcessHeap () returned 0x1130000 [0056.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40d00c0 | out: hHeap=0x1130000) returned 1 [0056.092] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0056.092] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0056.092] GetProcessHeap () returned 0x1130000 [0056.092] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40d00c0 [0056.092] lstrcpyW (in: lpString1=0x40d00c0, lpString2="\\\\?\\C:\\Users\\Public\\Music" | out: lpString1="\\\\?\\C:\\Users\\Public\\Music") returned="\\\\?\\C:\\Users\\Public\\Music" [0056.092] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 174 [0056.093] QueueUserWorkItem (Function=0x129a680, Context=0x40d00c0, Flags=0x0) returned 1 [0056.093] GetProcessHeap () returned 0x1130000 [0056.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40e00c8 [0056.093] wnsprintfW (in: pszDest=0x40e00c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Music\\*") returned 27 [0056.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Music\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.093] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.093] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.093] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.093] GetProcessHeap () returned 0x1130000 [0056.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40e00c8 | out: hHeap=0x1130000) returned 1 [0056.094] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0056.094] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0056.094] GetProcessHeap () returned 0x1130000 [0056.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40e00c8 [0056.094] lstrcpyW (in: lpString1=0x40e00c8, lpString2="\\\\?\\C:\\Users\\Public\\Pictures" | out: lpString1="\\\\?\\C:\\Users\\Public\\Pictures") returned="\\\\?\\C:\\Users\\Public\\Pictures" [0056.094] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 175 [0056.094] QueueUserWorkItem (Function=0x129a680, Context=0x40e00c8, Flags=0x0) returned 1 [0056.094] GetProcessHeap () returned 0x1130000 [0056.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40f00d0 [0056.095] wnsprintfW (in: pszDest=0x40f00d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Pictures\\*") returned 30 [0056.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.095] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.095] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.095] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.095] GetProcessHeap () returned 0x1130000 [0056.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40f00d0 | out: hHeap=0x1130000) returned 1 [0056.095] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0056.095] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0056.095] GetProcessHeap () returned 0x1130000 [0056.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40f00d0 [0056.095] lstrcpyW (in: lpString1=0x40f00d0, lpString2="\\\\?\\C:\\Users\\Public\\Videos" | out: lpString1="\\\\?\\C:\\Users\\Public\\Videos") returned="\\\\?\\C:\\Users\\Public\\Videos" [0056.095] InterlockedExchangeAdd (in: Addend=0x129f170, Value=1 | out: Addend=0x129f170) returned 176 [0056.095] QueueUserWorkItem (Function=0x129a680, Context=0x40f00d0, Flags=0x0) returned 1 [0056.095] GetProcessHeap () returned 0x1130000 [0056.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.096] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Videos\\*") returned 28 [0056.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\*", lpFindFileData=0xeef468 | out: lpFindFileData=0xeef468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.097] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0056.097] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.097] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.097] GetProcessHeap () returned 0x1130000 [0056.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.199] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.199] WriteFile (in: hFile=0x3b0, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeef944, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeef944*=0x9d7, lpOverlapped=0x0) returned 1 [0056.200] CloseHandle (hObject=0x3b0) returned 1 [0056.200] GetProcessHeap () returned 0x1130000 [0056.200] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.200] GetProcessHeap () returned 0x1130000 [0056.200] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.201] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0056.201] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0056.201] lstrcmpW (lpString1="Windows10Upgrade", lpString2="..") returned 1 [0056.201] lstrcmpW (lpString1="Windows10Upgrade", lpString2=".") returned 1 [0056.202] lstrlenA (lpString=" --= DEATHRANSOM =---\r\n\r\n***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************\r\n\r\n\x09*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****\r\n\r\n\r\n\r\nAll your files, documents, photos, databases and other important\r\nfiles are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method\r\nof recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nTo be sure we have the decryptor and it works you can send an\r\nemail death@firemail.cc and decrypt one file for free. But this\r\nfile should be of not valuable!\r\n\r\nDo you really want to restore your files?\r\n\r\nWrite to email \r\n death@cumallover.me\r\n\r\n death@firemail.cc\r\n\r\nYour LOCK-ID: QJjYZaXidFjDB1G37yUEIbeaEjyW9aVnf5fms8MdbVRbxcA/W6EGVdrvEhYvgAajBVRnuvLUxH4vZ0rWOtbE2tcrj3geliavOgBReHxUjzREo2GbrSH30lznr4NnSCXeY7xhzXiTOQP2A244QNwb0ciPdikyPq8EL6irIyYtD74lOwuObc4GFT5AT2eawlN0pXwwo/JTVgQA7UmwFhdVMW16e1ZWwxHeyuR1VXcKJGr94RY5+mezet0ZlreAQP3eAalemfjUsiQknjpAMcKkdQ/JOL/dHE38MrOFBQRhbcU9BiQ09fMU3ZlbbUyBAtZVZVa+U+WtEMVEfOO56V0z8p1bmvdxSZlilK/ScQkErphVeeu1f/ldL5HKdtj9kxkuYIl7DIKdXDBEJAEQeYqfC46eEMeuIH1dv8ANM0Ed+rzswIy93QJavQ75AxChOEDYHaylKtrK6/HgRqt/Vcl5An7aFpxsTLcn60sQfbtE/ulcSFIRjsGg18JfpYysHU36+r1ioyqLxvwNqGKaUpngDuzDJBVbSBnhCURyP+VgRsEZxkoBywKTjRY+RDrBCsFx5trlPMpJ2R1mJjgSotIL90AVMrcFw1uEv6KEvHowZrdPBCagt2vByvyLSSLaFlz3cAZ5y15jHcD37shvBRcDs4ymL+oZQMGg5E6Z9Z7joNgBZjpfxnToFTi5Wple/cCQ6GKK4kYiC1iLEJkmbZuM1Q==\r\n\r\n\r\n>>>How to obtain bitcoin:\r\n\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\n\r\nhttps://localbitcoins.com/buy_bitcoins\r\n\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\n\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n\r\n>>> Free decryption as guarantee!\r\n\r\nBefore paying you send us up to 1 file for free decryption.\r\n\r\nWe recommeded to send pictures, text files, sheets, etc. (files no more than 1mb)\r\n\r\n\r\n\r\nIN ORDER TO PREVENT DATA DAMAGE:\r\n\r\n1. Do not rename encrypted files.\r\n\r\n2. Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n\r\n3. Decryption of your files with the help of third parties may cause increased price (they add their fee to \r\nour) or you can become a victim of a scam.") returned 2519 [0056.202] WriteFile (in: hFile=0x3a8, lpBuffer=0x114ecf0*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0xeefe34, lpOverlapped=0x0 | out: lpBuffer=0x114ecf0*, lpNumberOfBytesWritten=0xeefe34*=0x9d7, lpOverlapped=0x0) returned 1 [0056.203] CloseHandle (hObject=0x3a8) returned 1 [0056.203] GetProcessHeap () returned 0x1130000 [0056.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x119bf80 | out: hHeap=0x1130000) returned 1 [0056.206] GetProcessHeap () returned 0x1130000 [0056.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x117bf70 | out: hHeap=0x1130000) returned 1 [0056.206] lstrlenW (lpString="C:\\") returned 3 [0056.206] Sleep (dwMilliseconds=0x1388) [0061.257] GetProcessHeap () returned 0x1130000 [0061.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x114ecf0 | out: hHeap=0x1130000) returned 1 [0061.258] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0x4c4 Thread: id = 3 os_tid = 0x654 [0052.611] GetProcessHeap () returned 0x1130000 [0052.611] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0052.611] GetProcessHeap () returned 0x1130000 [0052.611] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0052.611] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x121dfd0 [0052.612] ReadFile (in: hFile=0x3b8, lpBuffer=0x121dfd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c4fbec, lpOverlapped=0x0 | out: lpBuffer=0x121dfd0, lpNumberOfBytesRead=0x2c4fbec*=0x0, lpOverlapped=0x0) returned 0 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ba8 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11756d0 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0052.612] GetProcessHeap () returned 0x1130000 [0052.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0052.612] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0052.613] GetProcessHeap () returned 0x1130000 [0052.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0052.613] GetProcessHeap () returned 0x1130000 [0052.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.614] GetProcessHeap () returned 0x1130000 [0052.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121efd8 [0052.615] GetProcessHeap () returned 0x1130000 [0052.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.615] GetProcessHeap () returned 0x1130000 [0052.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0052.616] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.616] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0) returned 0 [0052.616] CloseHandle (hObject=0x3b8) returned 0 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0052.616] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 5 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0052.616] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x121dfd0 [0052.616] ReadFile (in: hFile=0x3b8, lpBuffer=0x121dfd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c4fbec, lpOverlapped=0x0 | out: lpBuffer=0x121dfd0, lpNumberOfBytesRead=0x2c4fbec*=0x0, lpOverlapped=0x0) returned 0 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175770 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c98, Size=0x20) returned 0x1175888 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0052.616] GetProcessHeap () returned 0x1130000 [0052.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.617] GetProcessHeap () returned 0x1130000 [0052.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177bf8 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177bf8 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0052.618] GetProcessHeap () returned 0x1130000 [0052.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.618] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.619] GetProcessHeap () returned 0x1130000 [0052.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121efd8 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0052.620] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.620] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0) returned 0 [0052.620] CloseHandle (hObject=0x3b8) returned 0 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0052.620] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 6 [0052.620] GetProcessHeap () returned 0x1130000 [0052.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0052.621] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x121dfd0 [0052.621] ReadFile (in: hFile=0x3b8, lpBuffer=0x121dfd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c4fbec, lpOverlapped=0x0 | out: lpBuffer=0x121dfd0, lpNumberOfBytesRead=0x2c4fbec*=0x0, lpOverlapped=0x0) returned 0 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175888 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.621] GetProcessHeap () returned 0x1130000 [0052.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0052.622] GetProcessHeap () returned 0x1130000 [0052.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.622] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.623] GetProcessHeap () returned 0x1130000 [0052.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.624] GetProcessHeap () returned 0x1130000 [0052.624] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.624] GetProcessHeap () returned 0x1130000 [0052.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121efd8 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0052.625] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.625] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0) returned 0 [0052.625] CloseHandle (hObject=0x3b8) returned 0 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0052.625] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 7 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0052.625] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x121dfd0 [0052.625] ReadFile (in: hFile=0x3b8, lpBuffer=0x121dfd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c4fbec, lpOverlapped=0x0 | out: lpBuffer=0x121dfd0, lpNumberOfBytesRead=0x2c4fbec*=0x0, lpOverlapped=0x0) returned 0 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0052.625] GetProcessHeap () returned 0x1130000 [0052.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x11758d8 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175ae0 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.626] GetProcessHeap () returned 0x1130000 [0052.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0052.626] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c58 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c58 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0052.627] GetProcessHeap () returned 0x1130000 [0052.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.628] GetProcessHeap () returned 0x1130000 [0052.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121efd8 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159380 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121efd8 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159380 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121efd8 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0052.629] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.629] WriteFile (in: hFile=0x3b8, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0) returned 0 [0052.629] CloseHandle (hObject=0x3b8) returned 0 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0052.629] GetProcessHeap () returned 0x1130000 [0052.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0052.629] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 8 [0052.630] GetProcessHeap () returned 0x1130000 [0052.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0052.631] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\*") returned 27 [0052.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0052.636] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\.") returned 27 [0052.637] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0052.637] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\..") returned 28 [0052.638] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1025", cAlternateFileName="")) returned 1 [0052.638] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025") returned 30 [0052.641] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1028", cAlternateFileName="")) returned 1 [0052.648] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028") returned 30 [0052.649] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1029", cAlternateFileName="")) returned 1 [0052.649] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029") returned 30 [0052.652] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1030", cAlternateFileName="")) returned 1 [0052.661] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1031", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1032", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1033", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1035", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1036", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1037", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1038", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1040", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1041", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1042", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1043", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1044", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1045", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1046", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1049", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1053", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053") returned 30 [0052.678] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="1055", cAlternateFileName="")) returned 1 [0052.678] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055") returned 30 [0052.679] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="2052", cAlternateFileName="")) returned 1 [0052.679] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052") returned 30 [0052.679] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="2070", cAlternateFileName="")) returned 1 [0052.679] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070") returned 30 [0052.679] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="3076", cAlternateFileName="")) returned 1 [0052.679] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076") returned 30 [0052.679] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="3082", cAlternateFileName="")) returned 1 [0052.679] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082") returned 30 [0052.679] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Client", cAlternateFileName="")) returned 1 [0052.679] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client") returned 32 [0052.679] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0052.679] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 42 [0052.679] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.679] StrStrW (lpFirst="DHtmlHeader.html", lpSrch=".wctc") returned 0x0 [0052.679] StrStrW (lpFirst="dhtmlheader.html", lpSrch="read_me.txt") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="autoexec.bat") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="desktop.ini") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="autorun.inf") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="ntuser.dat") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="iconcache.db") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="bootsect.bak") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="boot.ini") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="ntuser.dat.log") returned 0x0 [0052.680] StrStrW (lpFirst="dhtmlheader.html", lpSrch="thumbs.db") returned 0x0 [0052.680] GetProcessHeap () returned 0x1130000 [0052.680] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0052.681] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.wctc") returned 47 [0052.681] CloseHandle (hObject=0x3bc) returned 1 [0052.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.wctc" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.wctc")) returned 1 [0052.681] GetProcessHeap () returned 0x1130000 [0052.681] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0052.681] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 19 [0052.681] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0052.681] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0052.681] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 41 [0052.682] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.683] StrStrW (lpFirst="DisplayIcon.ico", lpSrch=".wctc") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="read_me.txt") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="autoexec.bat") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="desktop.ini") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="autorun.inf") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="ntuser.dat") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="iconcache.db") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="bootsect.bak") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="boot.ini") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="ntuser.dat.log") returned 0x0 [0052.683] StrStrW (lpFirst="displayicon.ico", lpSrch="thumbs.db") returned 0x0 [0052.683] GetProcessHeap () returned 0x1130000 [0052.684] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0052.684] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.wctc") returned 46 [0052.685] CloseHandle (hObject=0x3bc) returned 1 [0052.685] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.wctc")) returned 1 [0052.696] GetProcessHeap () returned 0x1130000 [0052.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0052.696] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 20 [0052.696] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0052.696] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Extended", cAlternateFileName="")) returned 1 [0052.696] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended") returned 34 [0052.696] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Graphics", cAlternateFileName="")) returned 1 [0052.696] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics") returned 34 [0052.696] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0052.696] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\header.bmp") returned 36 [0052.696] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.701] StrStrW (lpFirst="header.bmp", lpSrch=".wctc") returned 0x0 [0052.701] StrStrW (lpFirst="header.bmp", lpSrch="read_me.txt") returned 0x0 [0052.701] StrStrW (lpFirst="header.bmp", lpSrch="autoexec.bat") returned 0x0 [0052.701] StrStrW (lpFirst="header.bmp", lpSrch="desktop.ini") returned 0x0 [0052.701] StrStrW (lpFirst="header.bmp", lpSrch="autorun.inf") returned 0x0 [0052.701] StrStrW (lpFirst="header.bmp", lpSrch="ntuser.dat") returned 0x0 [0052.701] StrStrW (lpFirst="header.bmp", lpSrch="iconcache.db") returned 0x0 [0052.701] StrStrW (lpFirst="header.bmp", lpSrch="bootsect.bak") returned 0x0 [0052.701] StrStrW (lpFirst="header.bmp", lpSrch="boot.ini") returned 0x0 [0052.702] StrStrW (lpFirst="header.bmp", lpSrch="ntuser.dat.log") returned 0x0 [0052.702] StrStrW (lpFirst="header.bmp", lpSrch="thumbs.db") returned 0x0 [0052.702] GetProcessHeap () returned 0x1130000 [0052.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0052.702] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.wctc") returned 41 [0052.702] CloseHandle (hObject=0x3bc) returned 1 [0052.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.wctc" (normalized: "c:\\588bce7c90097ed212\\header.bmp.wctc")) returned 1 [0052.711] GetProcessHeap () returned 0x1130000 [0052.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0052.711] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 21 [0052.711] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0052.711] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0052.711] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 40 [0052.711] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.715] StrStrW (lpFirst="netfx_Core.mzz", lpSrch=".wctc") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="read_me.txt") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="autoexec.bat") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="desktop.ini") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="autorun.inf") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="ntuser.dat") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="iconcache.db") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="bootsect.bak") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="boot.ini") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="ntuser.dat.log") returned 0x0 [0052.716] StrStrW (lpFirst="netfx_core.mzz", lpSrch="thumbs.db") returned 0x0 [0052.716] GetProcessHeap () returned 0x1130000 [0052.716] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0052.717] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.wctc") returned 45 [0052.717] CloseHandle (hObject=0x3bc) returned 1 [0052.717] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.wctc" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.wctc")) returned 1 [0052.719] GetProcessHeap () returned 0x1130000 [0052.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0052.719] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 22 [0052.719] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0052.719] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0052.719] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 44 [0052.719] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.724] StrStrW (lpFirst="netfx_Core_x64.msi", lpSrch=".wctc") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="read_me.txt") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="autoexec.bat") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="desktop.ini") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="autorun.inf") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="ntuser.dat") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="iconcache.db") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="bootsect.bak") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="boot.ini") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="ntuser.dat.log") returned 0x0 [0052.724] StrStrW (lpFirst="netfx_core_x64.msi", lpSrch="thumbs.db") returned 0x0 [0052.724] GetProcessHeap () returned 0x1130000 [0052.724] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0052.725] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.wctc") returned 49 [0052.725] CloseHandle (hObject=0x3bc) returned 1 [0052.725] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.wctc" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.wctc")) returned 1 [0052.726] GetProcessHeap () returned 0x1130000 [0052.726] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0052.726] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 23 [0052.726] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0052.726] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0052.726] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 44 [0052.726] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.726] StrStrW (lpFirst="netfx_Core_x86.msi", lpSrch=".wctc") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="read_me.txt") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="autoexec.bat") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="desktop.ini") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="autorun.inf") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="ntuser.dat") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="iconcache.db") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="bootsect.bak") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="boot.ini") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="ntuser.dat.log") returned 0x0 [0052.727] StrStrW (lpFirst="netfx_core_x86.msi", lpSrch="thumbs.db") returned 0x0 [0052.727] GetProcessHeap () returned 0x1130000 [0052.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0052.727] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.wctc") returned 49 [0052.727] CloseHandle (hObject=0x3bc) returned 1 [0052.727] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.wctc" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.wctc")) returned 1 [0052.728] GetProcessHeap () returned 0x1130000 [0052.728] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0052.728] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 24 [0052.728] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0052.728] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0052.728] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 44 [0052.728] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0052.728] StrStrW (lpFirst="netfx_Extended.mzz", lpSrch=".wctc") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="read_me.txt") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="autoexec.bat") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="desktop.ini") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="autorun.inf") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="ntuser.dat") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="iconcache.db") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="bootsect.bak") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="boot.ini") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="ntuser.dat.log") returned 0x0 [0052.728] StrStrW (lpFirst="netfx_extended.mzz", lpSrch="thumbs.db") returned 0x0 [0052.728] GetProcessHeap () returned 0x1130000 [0052.728] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0052.728] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.wctc") returned 49 [0052.728] CloseHandle (hObject=0x3bc) returned 1 [0052.728] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.wctc" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.wctc")) returned 1 [0052.729] GetProcessHeap () returned 0x1130000 [0052.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0052.729] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 25 [0052.729] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0052.729] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0052.729] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 48 [0052.729] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.109] StrStrW (lpFirst="netfx_Extended_x64.msi", lpSrch=".wctc") returned 0x0 [0053.109] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="read_me.txt") returned 0x0 [0053.109] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="autoexec.bat") returned 0x0 [0053.109] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="desktop.ini") returned 0x0 [0053.109] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="autorun.inf") returned 0x0 [0053.109] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="ntuser.dat") returned 0x0 [0053.109] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="iconcache.db") returned 0x0 [0053.110] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="bootsect.bak") returned 0x0 [0053.110] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="boot.ini") returned 0x0 [0053.110] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="ntuser.dat.log") returned 0x0 [0053.110] StrStrW (lpFirst="netfx_extended_x64.msi", lpSrch="thumbs.db") returned 0x0 [0053.110] GetProcessHeap () returned 0x1130000 [0053.110] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36a00a8 [0053.111] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.wctc") returned 53 [0053.111] CloseHandle (hObject=0x3b4) returned 1 [0053.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.wctc" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.wctc")) returned 1 [0053.114] GetProcessHeap () returned 0x1130000 [0053.114] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36a00a8 | out: hHeap=0x1130000) returned 1 [0053.114] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 32 [0053.114] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.114] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0053.115] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 48 [0053.115] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.116] StrStrW (lpFirst="netfx_Extended_x86.msi", lpSrch=".wctc") returned 0x0 [0053.116] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="read_me.txt") returned 0x0 [0053.116] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="autoexec.bat") returned 0x0 [0053.116] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="desktop.ini") returned 0x0 [0053.116] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="autorun.inf") returned 0x0 [0053.116] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="ntuser.dat") returned 0x0 [0053.117] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="iconcache.db") returned 0x0 [0053.117] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="bootsect.bak") returned 0x0 [0053.117] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="boot.ini") returned 0x0 [0053.117] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="ntuser.dat.log") returned 0x0 [0053.117] StrStrW (lpFirst="netfx_extended_x86.msi", lpSrch="thumbs.db") returned 0x0 [0053.117] GetProcessHeap () returned 0x1130000 [0053.117] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0053.117] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.wctc") returned 53 [0053.117] CloseHandle (hObject=0x3b4) returned 1 [0053.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.wctc" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.wctc")) returned 1 [0053.117] GetProcessHeap () returned 0x1130000 [0053.117] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0053.117] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 33 [0053.117] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.117] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0053.117] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 43 [0053.117] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.123] StrStrW (lpFirst="ParameterInfo.xml", lpSrch=".wctc") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="read_me.txt") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="autoexec.bat") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="desktop.ini") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="autorun.inf") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="ntuser.dat") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="iconcache.db") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="bootsect.bak") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="boot.ini") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.123] StrStrW (lpFirst="parameterinfo.xml", lpSrch="thumbs.db") returned 0x0 [0053.123] GetProcessHeap () returned 0x1130000 [0053.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0053.124] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.wctc") returned 48 [0053.124] CloseHandle (hObject=0x3b4) returned 1 [0053.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.wctc")) returned 1 [0053.132] GetProcessHeap () returned 0x1130000 [0053.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0053.132] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 34 [0053.132] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.132] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0053.132] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 42 [0053.132] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.137] StrStrW (lpFirst="RGB9RAST_x64.msi", lpSrch=".wctc") returned 0x0 [0053.137] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="read_me.txt") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="autoexec.bat") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="desktop.ini") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="autorun.inf") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="ntuser.dat") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="iconcache.db") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="bootsect.bak") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="boot.ini") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="ntuser.dat.log") returned 0x0 [0053.138] StrStrW (lpFirst="rgb9rast_x64.msi", lpSrch="thumbs.db") returned 0x0 [0053.138] GetProcessHeap () returned 0x1130000 [0053.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37f0050 [0053.139] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.wctc") returned 47 [0053.139] CloseHandle (hObject=0x3b4) returned 1 [0053.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.wctc" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.wctc")) returned 1 [0053.141] GetProcessHeap () returned 0x1130000 [0053.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37f0050 | out: hHeap=0x1130000) returned 1 [0053.141] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 35 [0053.141] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.141] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0053.141] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 42 [0053.141] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.141] StrStrW (lpFirst="RGB9Rast_x86.msi", lpSrch=".wctc") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="read_me.txt") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="autoexec.bat") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="desktop.ini") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="autorun.inf") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="ntuser.dat") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="iconcache.db") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="bootsect.bak") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="boot.ini") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="ntuser.dat.log") returned 0x0 [0053.141] StrStrW (lpFirst="rgb9rast_x86.msi", lpSrch="thumbs.db") returned 0x0 [0053.141] GetProcessHeap () returned 0x1130000 [0053.141] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37f0050 [0053.141] wnsprintfW (in: pszDest=0x37f0050, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.wctc") returned 47 [0053.141] CloseHandle (hObject=0x3b4) returned 1 [0053.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.wctc" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.wctc")) returned 1 [0053.142] GetProcessHeap () returned 0x1130000 [0053.142] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37f0050 | out: hHeap=0x1130000) returned 1 [0053.142] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 36 [0053.142] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.142] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0053.142] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe") returned 35 [0053.142] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.147] StrStrW (lpFirst="Setup.exe", lpSrch=".wctc") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="read_me.txt") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="autoexec.bat") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="desktop.ini") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="autorun.inf") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="ntuser.dat") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="iconcache.db") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="bootsect.bak") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="boot.ini") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="ntuser.dat.log") returned 0x0 [0053.147] StrStrW (lpFirst="setup.exe", lpSrch="thumbs.db") returned 0x0 [0053.148] GetProcessHeap () returned 0x1130000 [0053.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3800058 [0053.149] wnsprintfW (in: pszDest=0x3800058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.wctc") returned 40 [0053.149] CloseHandle (hObject=0x3b4) returned 1 [0053.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.wctc" (normalized: "c:\\588bce7c90097ed212\\setup.exe.wctc")) returned 1 [0053.157] GetProcessHeap () returned 0x1130000 [0053.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3800058 | out: hHeap=0x1130000) returned 1 [0053.157] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 37 [0053.157] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.157] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0053.157] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll") returned 41 [0053.157] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.160] StrStrW (lpFirst="SetupEngine.dll", lpSrch=".wctc") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="read_me.txt") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="autoexec.bat") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="desktop.ini") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="autorun.inf") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="ntuser.dat") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="iconcache.db") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="bootsect.bak") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="boot.ini") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.160] StrStrW (lpFirst="setupengine.dll", lpSrch="thumbs.db") returned 0x0 [0053.160] GetProcessHeap () returned 0x1130000 [0053.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3800058 [0053.160] wnsprintfW (in: pszDest=0x3800058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.wctc") returned 46 [0053.160] CloseHandle (hObject=0x3b4) returned 1 [0053.161] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.wctc")) returned 1 [0053.353] GetProcessHeap () returned 0x1130000 [0053.356] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3800058 | out: hHeap=0x1130000) returned 1 [0053.370] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 50 [0053.370] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.370] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0053.370] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll") returned 37 [0053.370] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.370] StrStrW (lpFirst="SetupUi.dll", lpSrch=".wctc") returned 0x0 [0053.370] StrStrW (lpFirst="setupui.dll", lpSrch="read_me.txt") returned 0x0 [0053.370] StrStrW (lpFirst="setupui.dll", lpSrch="autoexec.bat") returned 0x0 [0053.370] StrStrW (lpFirst="setupui.dll", lpSrch="desktop.ini") returned 0x0 [0053.371] StrStrW (lpFirst="setupui.dll", lpSrch="autorun.inf") returned 0x0 [0053.371] StrStrW (lpFirst="setupui.dll", lpSrch="ntuser.dat") returned 0x0 [0053.371] StrStrW (lpFirst="setupui.dll", lpSrch="iconcache.db") returned 0x0 [0053.371] StrStrW (lpFirst="setupui.dll", lpSrch="bootsect.bak") returned 0x0 [0053.371] StrStrW (lpFirst="setupui.dll", lpSrch="boot.ini") returned 0x0 [0053.371] StrStrW (lpFirst="setupui.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.371] StrStrW (lpFirst="setupui.dll", lpSrch="thumbs.db") returned 0x0 [0053.371] GetProcessHeap () returned 0x1130000 [0053.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.372] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.wctc") returned 42 [0053.372] CloseHandle (hObject=0x3c0) returned 1 [0053.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.wctc")) returned 1 [0053.372] GetProcessHeap () returned 0x1130000 [0053.372] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.372] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 51 [0053.372] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.372] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0053.372] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd") returned 37 [0053.372] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.373] StrStrW (lpFirst="SetupUi.xsd", lpSrch=".wctc") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="read_me.txt") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="autoexec.bat") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="desktop.ini") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="autorun.inf") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="ntuser.dat") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="iconcache.db") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="bootsect.bak") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="boot.ini") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="ntuser.dat.log") returned 0x0 [0053.373] StrStrW (lpFirst="setupui.xsd", lpSrch="thumbs.db") returned 0x0 [0053.373] GetProcessHeap () returned 0x1130000 [0053.373] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.373] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.wctc") returned 42 [0053.373] CloseHandle (hObject=0x3c0) returned 1 [0053.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.wctc" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.wctc")) returned 1 [0053.373] GetProcessHeap () returned 0x1130000 [0053.374] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.374] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 52 [0053.374] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.374] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0053.374] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe") returned 42 [0053.374] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.374] StrStrW (lpFirst="SetupUtility.exe", lpSrch=".wctc") returned 0x0 [0053.374] StrStrW (lpFirst="setuputility.exe", lpSrch="read_me.txt") returned 0x0 [0053.374] StrStrW (lpFirst="setuputility.exe", lpSrch="autoexec.bat") returned 0x0 [0053.374] StrStrW (lpFirst="setuputility.exe", lpSrch="desktop.ini") returned 0x0 [0053.374] StrStrW (lpFirst="setuputility.exe", lpSrch="autorun.inf") returned 0x0 [0053.374] StrStrW (lpFirst="setuputility.exe", lpSrch="ntuser.dat") returned 0x0 [0053.374] StrStrW (lpFirst="setuputility.exe", lpSrch="iconcache.db") returned 0x0 [0053.374] StrStrW (lpFirst="setuputility.exe", lpSrch="bootsect.bak") returned 0x0 [0053.374] StrStrW (lpFirst="setuputility.exe", lpSrch="boot.ini") returned 0x0 [0053.375] StrStrW (lpFirst="setuputility.exe", lpSrch="ntuser.dat.log") returned 0x0 [0053.375] StrStrW (lpFirst="setuputility.exe", lpSrch="thumbs.db") returned 0x0 [0053.375] GetProcessHeap () returned 0x1130000 [0053.375] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.375] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.wctc") returned 47 [0053.375] CloseHandle (hObject=0x3c0) returned 1 [0053.375] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.wctc" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.wctc")) returned 1 [0053.375] GetProcessHeap () returned 0x1130000 [0053.375] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.375] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 53 [0053.375] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.375] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0053.375] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 42 [0053.375] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.375] StrStrW (lpFirst="SplashScreen.bmp", lpSrch=".wctc") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="read_me.txt") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="autoexec.bat") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="desktop.ini") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="autorun.inf") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="ntuser.dat") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="iconcache.db") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="bootsect.bak") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="boot.ini") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="ntuser.dat.log") returned 0x0 [0053.376] StrStrW (lpFirst="splashscreen.bmp", lpSrch="thumbs.db") returned 0x0 [0053.376] GetProcessHeap () returned 0x1130000 [0053.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.376] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.wctc") returned 47 [0053.376] CloseHandle (hObject=0x3c0) returned 1 [0053.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.wctc" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.wctc")) returned 1 [0053.376] GetProcessHeap () returned 0x1130000 [0053.376] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.376] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 54 [0053.377] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.377] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0053.377] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll") returned 36 [0053.377] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch=".wctc") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="read_me.txt") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="autoexec.bat") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="desktop.ini") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="autorun.inf") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="ntuser.dat") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="iconcache.db") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="bootsect.bak") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="boot.ini") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.377] StrStrW (lpFirst="sqmapi.dll", lpSrch="thumbs.db") returned 0x0 [0053.377] GetProcessHeap () returned 0x1130000 [0053.377] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.377] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.wctc") returned 41 [0053.377] CloseHandle (hObject=0x3c0) returned 1 [0053.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.wctc")) returned 1 [0053.378] GetProcessHeap () returned 0x1130000 [0053.378] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.378] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 55 [0053.378] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.378] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0053.378] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml") returned 37 [0053.378] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.378] StrStrW (lpFirst="Strings.xml", lpSrch=".wctc") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="read_me.txt") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="autoexec.bat") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="desktop.ini") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="autorun.inf") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="ntuser.dat") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="iconcache.db") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="bootsect.bak") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="boot.ini") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.378] StrStrW (lpFirst="strings.xml", lpSrch="thumbs.db") returned 0x0 [0053.379] GetProcessHeap () returned 0x1130000 [0053.379] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.379] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.wctc") returned 42 [0053.379] CloseHandle (hObject=0x3c0) returned 1 [0053.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\strings.xml.wctc")) returned 1 [0053.379] GetProcessHeap () returned 0x1130000 [0053.379] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.379] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 56 [0053.379] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.379] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0053.379] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml") returned 36 [0053.379] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.379] StrStrW (lpFirst="UiInfo.xml", lpSrch=".wctc") returned 0x0 [0053.379] StrStrW (lpFirst="uiinfo.xml", lpSrch="read_me.txt") returned 0x0 [0053.379] StrStrW (lpFirst="uiinfo.xml", lpSrch="autoexec.bat") returned 0x0 [0053.379] StrStrW (lpFirst="uiinfo.xml", lpSrch="desktop.ini") returned 0x0 [0053.380] StrStrW (lpFirst="uiinfo.xml", lpSrch="autorun.inf") returned 0x0 [0053.380] StrStrW (lpFirst="uiinfo.xml", lpSrch="ntuser.dat") returned 0x0 [0053.380] StrStrW (lpFirst="uiinfo.xml", lpSrch="iconcache.db") returned 0x0 [0053.380] StrStrW (lpFirst="uiinfo.xml", lpSrch="bootsect.bak") returned 0x0 [0053.380] StrStrW (lpFirst="uiinfo.xml", lpSrch="boot.ini") returned 0x0 [0053.380] StrStrW (lpFirst="uiinfo.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.380] StrStrW (lpFirst="uiinfo.xml", lpSrch="thumbs.db") returned 0x0 [0053.380] GetProcessHeap () returned 0x1130000 [0053.380] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.380] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.wctc") returned 41 [0053.380] CloseHandle (hObject=0x3c0) returned 1 [0053.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.wctc")) returned 1 [0053.380] GetProcessHeap () returned 0x1130000 [0053.380] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.380] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 57 [0053.380] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.380] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0053.381] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp") returned 39 [0053.381] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch=".wctc") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="read_me.txt") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="autoexec.bat") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="desktop.ini") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="autorun.inf") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="ntuser.dat") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="iconcache.db") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="bootsect.bak") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="boot.ini") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="ntuser.dat.log") returned 0x0 [0053.381] StrStrW (lpFirst="watermark.bmp", lpSrch="thumbs.db") returned 0x0 [0053.381] GetProcessHeap () returned 0x1130000 [0053.381] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.381] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.wctc") returned 44 [0053.381] CloseHandle (hObject=0x3c0) returned 1 [0053.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.wctc" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.wctc")) returned 1 [0053.382] GetProcessHeap () returned 0x1130000 [0053.382] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.382] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 58 [0053.382] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.382] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0053.382] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 59 [0053.382] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.383] StrStrW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch=".wctc") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="read_me.txt") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="autoexec.bat") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="desktop.ini") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="autorun.inf") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="ntuser.dat") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="iconcache.db") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="bootsect.bak") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="boot.ini") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="ntuser.dat.log") returned 0x0 [0053.383] StrStrW (lpFirst="windows6.0-kb956250-v6001-x64.msu", lpSrch="thumbs.db") returned 0x0 [0053.383] GetProcessHeap () returned 0x1130000 [0053.383] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.383] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.wctc") returned 64 [0053.383] CloseHandle (hObject=0x3c0) returned 1 [0053.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.wctc" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.wctc")) returned 1 [0053.384] GetProcessHeap () returned 0x1130000 [0053.384] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.384] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 59 [0053.384] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.384] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0053.384] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 59 [0053.384] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.384] StrStrW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch=".wctc") returned 0x0 [0053.384] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="read_me.txt") returned 0x0 [0053.384] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="autoexec.bat") returned 0x0 [0053.384] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="desktop.ini") returned 0x0 [0053.384] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="autorun.inf") returned 0x0 [0053.384] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="ntuser.dat") returned 0x0 [0053.384] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="iconcache.db") returned 0x0 [0053.384] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="bootsect.bak") returned 0x0 [0053.384] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="boot.ini") returned 0x0 [0053.385] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="ntuser.dat.log") returned 0x0 [0053.385] StrStrW (lpFirst="windows6.0-kb956250-v6001-x86.msu", lpSrch="thumbs.db") returned 0x0 [0053.385] GetProcessHeap () returned 0x1130000 [0053.385] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.385] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.wctc") returned 64 [0053.385] CloseHandle (hObject=0x3c0) returned 1 [0053.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.wctc" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.wctc")) returned 1 [0053.388] GetProcessHeap () returned 0x1130000 [0053.388] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.388] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 60 [0053.388] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0053.388] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 59 [0053.388] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.388] StrStrW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch=".wctc") returned 0x0 [0053.388] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="read_me.txt") returned 0x0 [0053.388] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="autoexec.bat") returned 0x0 [0053.388] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="desktop.ini") returned 0x0 [0053.388] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="autorun.inf") returned 0x0 [0053.388] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="ntuser.dat") returned 0x0 [0053.389] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="iconcache.db") returned 0x0 [0053.389] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="bootsect.bak") returned 0x0 [0053.389] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="boot.ini") returned 0x0 [0053.389] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="ntuser.dat.log") returned 0x0 [0053.389] StrStrW (lpFirst="windows6.1-kb958488-v6001-x64.msu", lpSrch="thumbs.db") returned 0x0 [0053.389] GetProcessHeap () returned 0x1130000 [0053.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.389] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.wctc") returned 64 [0053.389] CloseHandle (hObject=0x3c0) returned 1 [0053.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.wctc" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.wctc")) returned 1 [0053.389] GetProcessHeap () returned 0x1130000 [0053.389] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.389] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 61 [0053.390] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.390] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0053.390] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 59 [0053.390] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.390] StrStrW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch=".wctc") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="read_me.txt") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="autoexec.bat") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="desktop.ini") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="autorun.inf") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="ntuser.dat") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="iconcache.db") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="bootsect.bak") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="boot.ini") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="ntuser.dat.log") returned 0x0 [0053.390] StrStrW (lpFirst="windows6.1-kb958488-v6001-x86.msu", lpSrch="thumbs.db") returned 0x0 [0053.390] GetProcessHeap () returned 0x1130000 [0053.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3880098 [0053.390] wnsprintfW (in: pszDest=0x3880098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.wctc") returned 64 [0053.390] CloseHandle (hObject=0x3c0) returned 1 [0053.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.wctc" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.wctc")) returned 1 [0053.391] GetProcessHeap () returned 0x1130000 [0053.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0053.391] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 62 [0053.391] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.391] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x3b8, dwReserved1=0x77c08fcf, cFileName="windows6.1-kb958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0053.391] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.391] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\read_me.txt") returned 37 [0053.391] GetProcessHeap () returned 0x1130000 [0053.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.391] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 13 [0053.391] GetProcessHeap () returned 0x1130000 [0053.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0053.393] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3698108 [0053.393] ReadFile (in: hFile=0x3bc, lpBuffer=0x3698108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c4fbec, lpOverlapped=0x0 | out: lpBuffer=0x3698108, lpNumberOfBytesRead=0x2c4fbec*=0x0, lpOverlapped=0x0) returned 0 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175748 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.393] GetProcessHeap () returned 0x1130000 [0053.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.393] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.394] GetProcessHeap () returned 0x1130000 [0053.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.395] GetProcessHeap () returned 0x1130000 [0053.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.395] GetProcessHeap () returned 0x1130000 [0053.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.396] GetProcessHeap () returned 0x1130000 [0053.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.397] GetProcessHeap () returned 0x1130000 [0053.397] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.397] GetProcessHeap () returned 0x1130000 [0053.397] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121dfd0 [0053.397] GetProcessHeap () returned 0x1130000 [0053.397] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.397] GetProcessHeap () returned 0x1130000 [0053.397] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.397] GetProcessHeap () returned 0x1130000 [0053.397] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0053.397] GetProcessHeap () returned 0x1130000 [0053.397] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.397] GetProcessHeap () returned 0x1130000 [0053.397] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0053.397] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.239] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x2c4fc08, lpOverlapped=0x0) returned 0 [0054.240] CloseHandle (hObject=0x3bc) returned 0 [0054.240] GetProcessHeap () returned 0x1130000 [0054.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3698108 | out: hHeap=0x1130000) returned 1 [0054.240] GetProcessHeap () returned 0x1130000 [0054.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0054.240] GetProcessHeap () returned 0x1130000 [0054.240] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0054.240] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 31 [0054.240] GetProcessHeap () returned 0x1130000 [0054.240] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0054.240] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\*") returned 32 [0054.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0054.240] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\.") returned 32 [0054.240] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0054.241] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\..") returned 33 [0054.241] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0054.241] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 39 [0054.241] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0054.241] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0054.241] GetProcessHeap () returned 0x1130000 [0054.241] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38900a0 [0054.242] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.wctc") returned 44 [0054.242] CloseHandle (hObject=0x3c0) returned 1 [0054.242] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.wctc")) returned 1 [0054.254] GetProcessHeap () returned 0x1130000 [0054.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0054.254] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 102 [0054.254] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.254] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0054.254] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 48 [0054.254] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.254] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0054.254] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0054.254] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0054.254] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0054.254] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0054.254] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0054.254] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0054.254] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0054.255] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0054.255] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0054.255] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0054.255] GetProcessHeap () returned 0x1130000 [0054.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38900a0 [0054.255] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.wctc") returned 53 [0054.255] CloseHandle (hObject=0x3c0) returned 1 [0054.255] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.wctc")) returned 1 [0054.255] GetProcessHeap () returned 0x1130000 [0054.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0054.255] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 103 [0054.255] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.255] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf16b88a2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf16b88a2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0054.255] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\read_me.txt") returned 42 [0054.255] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.255] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0054.255] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0054.255] CloseHandle (hObject=0x3c0) returned 1 [0054.256] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0054.256] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 49 [0054.256] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.256] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0054.256] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0054.256] GetProcessHeap () returned 0x1130000 [0054.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38900a0 [0054.256] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.wctc") returned 54 [0054.256] CloseHandle (hObject=0x3c0) returned 1 [0054.256] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.wctc")) returned 1 [0054.257] GetProcessHeap () returned 0x1130000 [0054.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0054.257] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 104 [0054.257] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.257] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x2c4fa20 | out: lpFindFileData=0x2c4fa20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0054.257] FindClose (in: hFindFile=0x1170aa0 | out: hFindFile=0x1170aa0) returned 1 [0054.257] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2070\\read_me.txt") returned 42 [0054.257] GetProcessHeap () returned 0x1130000 [0054.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0054.257] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 27 [0054.257] GetProcessHeap () returned 0x1130000 [0054.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 Thread: id = 4 os_tid = 0xa8c [0052.409] GetProcessHeap () returned 0x1130000 [0052.409] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fbfb0 [0052.410] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\*") returned 8 [0052.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x753eb8cc, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x1170c60 [0052.411] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent") returned 18 [0052.411] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x753eb8cc, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0052.411] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$Recycle.Bin") returned 19 [0052.411] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x753eb8cc, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0052.411] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 37 [0052.411] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0052.412] StrStrW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch=".wctc") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="read_me.txt") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="autoexec.bat") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="desktop.ini") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="autorun.inf") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="ntuser.dat") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="iconcache.db") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="bootsect.bak") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="boot.ini") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="ntuser.dat.log") returned 0x0 [0052.412] StrStrW (lpFirst="$winre_backup_partition.marker", lpSrch="thumbs.db") returned 0x0 [0052.412] GetProcessHeap () returned 0x1130000 [0052.413] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120cfc0 [0052.413] wnsprintfW (in: pszDest=0x120cfc0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER.wctc") returned 42 [0052.413] CloseHandle (hObject=0x3b4) returned 1 [0052.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), lpNewFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER.wctc" (normalized: "c:\\$winre_backup_partition.marker.wctc")) returned 1 [0052.414] GetProcessHeap () returned 0x1130000 [0052.414] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120cfc0 | out: hHeap=0x1130000) returned 1 [0052.415] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 0 [0052.415] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0052.415] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x753eb8cc, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0052.415] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212") returned 25 [0052.415] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x753eb8cc, cFileName="Boot", cAlternateFileName="")) returned 1 [0052.415] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot") returned 11 [0052.415] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x753eb8cc, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0052.415] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\bootmgr") returned 14 [0052.415] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.416] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x753eb8cc, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0052.416] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\BOOTNXT") returned 14 [0052.416] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0052.417] StrStrW (lpFirst="BOOTNXT", lpSrch=".wctc") returned 0x0 [0052.417] StrStrW (lpFirst="bootnxt", lpSrch="read_me.txt") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="autoexec.bat") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="desktop.ini") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="autorun.inf") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="ntuser.dat") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="iconcache.db") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="bootsect.bak") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="boot.ini") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="ntuser.dat.log") returned 0x0 [0052.418] StrStrW (lpFirst="bootnxt", lpSrch="thumbs.db") returned 0x0 [0052.418] GetProcessHeap () returned 0x1130000 [0052.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120cfc0 [0052.419] wnsprintfW (in: pszDest=0x120cfc0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\BOOTNXT.wctc") returned 19 [0052.419] CloseHandle (hObject=0x3b4) returned 1 [0052.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), lpNewFileName="\\\\?\\C:\\BOOTNXT.wctc" (normalized: "c:\\bootnxt.wctc")) returned 1 [0052.419] GetProcessHeap () returned 0x1130000 [0052.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120cfc0 | out: hHeap=0x1130000) returned 1 [0052.420] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 1 [0052.420] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0052.420] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x753eb8cc, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0052.420] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\BOOTSECT.BAK") returned 19 [0052.420] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.420] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0052.420] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Documents and Settings") returned 29 [0052.420] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="ESD", cAlternateFileName="")) returned 1 [0052.420] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ESD") returned 10 [0052.420] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0052.420] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\hiberfil.sys") returned 19 [0052.420] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.421] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Logs", cAlternateFileName="")) returned 1 [0052.421] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs") returned 11 [0052.421] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\pagefile.sys") returned 19 [0052.422] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs") returned 15 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd9876ae2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xd9876ae2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Program Files") returned 20 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Program Files (x86)") returned 26 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData") returned 18 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Recovery", cAlternateFileName="")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery") returned 15 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\swapfile.sys") returned 19 [0052.422] CreateFileW (lpFileName="\\\\?\\C:\\swapfile.sys" (normalized: "c:\\swapfile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\System Volume Information") returned 32 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Users", cAlternateFileName="")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users") returned 12 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Windows", cAlternateFileName="")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Windows") returned 14 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0052.422] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Windows10Upgrade") returned 23 [0052.422] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0052.422] FindClose (in: hFindFile=0x1170c60 | out: hFindFile=0x1170c60) returned 1 [0052.423] wnsprintfW (in: pszDest=0x11fbfb0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\read_me.txt") returned 18 [0052.423] GetProcessHeap () returned 0x1130000 [0052.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fbfb0 | out: hHeap=0x1130000) returned 1 [0052.423] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 0 [0052.423] GetProcessHeap () returned 0x1130000 [0052.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0052.424] GetProcessHeap () returned 0x1130000 [0052.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0052.424] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\$GetCurrent\\*") returned 20 [0052.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0052.425] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\.") returned 20 [0052.425] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="..", cAlternateFileName="")) returned 1 [0052.425] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\..") returned 21 [0052.425] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="Logs", cAlternateFileName="")) returned 1 [0052.425] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs") returned 23 [0052.425] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0052.425] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS") returned 25 [0052.425] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0052.425] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0052.425] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\$GetCurrent\\read_me.txt") returned 30 [0052.425] GetProcessHeap () returned 0x1130000 [0052.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0052.426] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 1 [0052.426] GetProcessHeap () returned 0x1130000 [0052.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11abf88 | out: hHeap=0x1130000) returned 1 [0052.426] GetProcessHeap () returned 0x1130000 [0052.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11abf88 [0052.427] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\*") returned 25 [0052.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf0ed2a7c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0052.427] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\.") returned 25 [0052.427] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf0ed2a7c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="..", cAlternateFileName="")) returned 1 [0052.427] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\..") returned 26 [0052.427] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0052.427] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 61 [0052.427] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch=".wctc") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="read_me.txt") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="autoexec.bat") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="desktop.ini") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="autorun.inf") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="ntuser.dat") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="iconcache.db") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="bootsect.bak") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="boot.ini") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="ntuser.dat.log") returned 0x0 [0052.428] StrStrW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="thumbs.db") returned 0x0 [0052.428] GetProcessHeap () returned 0x1130000 [0052.428] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0052.429] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.wctc") returned 66 [0052.429] CloseHandle (hObject=0x3b8) returned 1 [0052.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.wctc" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.wctc")) returned 1 [0052.430] GetProcessHeap () returned 0x1130000 [0052.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0052.430] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 2 [0052.430] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0052.430] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0052.430] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 56 [0052.430] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.432] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch=".wctc") returned 0x0 [0052.432] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="read_me.txt") returned 0x0 [0052.432] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="autoexec.bat") returned 0x0 [0052.432] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="desktop.ini") returned 0x0 [0052.432] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="autorun.inf") returned 0x0 [0052.432] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="ntuser.dat") returned 0x0 [0052.432] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="iconcache.db") returned 0x0 [0052.433] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="bootsect.bak") returned 0x0 [0052.433] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="boot.ini") returned 0x0 [0052.433] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="ntuser.dat.log") returned 0x0 [0052.433] StrStrW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="thumbs.db") returned 0x0 [0052.433] GetProcessHeap () returned 0x1130000 [0052.433] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0052.433] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.wctc") returned 61 [0052.433] CloseHandle (hObject=0x3b8) returned 1 [0052.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.wctc" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.wctc")) returned 1 [0052.434] GetProcessHeap () returned 0x1130000 [0052.434] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0052.434] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 3 [0052.434] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0052.434] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0052.434] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 54 [0052.434] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.435] StrStrW (lpFirst="PartnerSetupCompleteResult.log", lpSrch=".wctc") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="read_me.txt") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="autoexec.bat") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="desktop.ini") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="autorun.inf") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="ntuser.dat") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="iconcache.db") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="bootsect.bak") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="boot.ini") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="ntuser.dat.log") returned 0x0 [0052.435] StrStrW (lpFirst="partnersetupcompleteresult.log", lpSrch="thumbs.db") returned 0x0 [0052.435] GetProcessHeap () returned 0x1130000 [0052.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0052.436] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.wctc") returned 59 [0052.436] CloseHandle (hObject=0x3b8) returned 1 [0052.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.wctc" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.wctc")) returned 1 [0052.436] GetProcessHeap () returned 0x1130000 [0052.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0052.437] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 4 [0052.437] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0052.437] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ed2a7c, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf0ed2a7c, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf0ed2a7c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0052.437] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\read_me.txt") returned 35 [0052.437] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\read_me.txt" (normalized: "c:\\$getcurrent\\logs\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.437] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0052.438] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0052.438] CloseHandle (hObject=0x3b8) returned 1 [0052.438] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ed2a7c, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf0ed2a7c, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf0ed2a7c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0052.438] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0052.438] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\$GetCurrent\\Logs\\read_me.txt") returned 35 [0052.438] GetProcessHeap () returned 0x1130000 [0052.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11abf88 | out: hHeap=0x1130000) returned 1 [0052.438] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 2 [0052.438] GetProcessHeap () returned 0x1130000 [0052.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cbf98 | out: hHeap=0x1130000) returned 1 [0052.439] GetProcessHeap () returned 0x1130000 [0052.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cbf98 [0052.439] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\*") returned 27 [0052.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0052.441] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\.") returned 27 [0052.441] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="..", cAlternateFileName="")) returned 1 [0052.441] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\..") returned 28 [0052.441] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0052.441] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 44 [0052.441] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.443] StrStrW (lpFirst="GetCurrentOOBE.dll", lpSrch=".wctc") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="read_me.txt") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="autoexec.bat") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="desktop.ini") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="autorun.inf") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="ntuser.dat") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="iconcache.db") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="bootsect.bak") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="boot.ini") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="ntuser.dat.log") returned 0x0 [0052.443] StrStrW (lpFirst="getcurrentoobe.dll", lpSrch="thumbs.db") returned 0x0 [0052.443] GetProcessHeap () returned 0x1130000 [0052.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11abf88 [0052.444] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.wctc") returned 49 [0052.444] CloseHandle (hObject=0x3b8) returned 1 [0052.444] MoveFileW (lpExistingFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), lpNewFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.wctc" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.wctc")) returned 1 [0052.445] GetProcessHeap () returned 0x1130000 [0052.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11abf88 | out: hHeap=0x1130000) returned 1 [0052.445] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 5 [0052.445] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0052.445] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0052.445] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 48 [0052.445] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.446] StrStrW (lpFirst="GetCurrentRollback.ini", lpSrch=".wctc") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="read_me.txt") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="autoexec.bat") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="desktop.ini") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="autorun.inf") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="ntuser.dat") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="iconcache.db") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="bootsect.bak") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="boot.ini") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="ntuser.dat.log") returned 0x0 [0052.446] StrStrW (lpFirst="getcurrentrollback.ini", lpSrch="thumbs.db") returned 0x0 [0052.447] GetProcessHeap () returned 0x1130000 [0052.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11abf88 [0052.447] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.wctc") returned 53 [0052.447] CloseHandle (hObject=0x3b8) returned 1 [0052.447] MoveFileW (lpExistingFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), lpNewFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.wctc" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.wctc")) returned 1 [0052.447] GetProcessHeap () returned 0x1130000 [0052.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11abf88 | out: hHeap=0x1130000) returned 1 [0052.447] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 6 [0052.447] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0052.448] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0052.448] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 50 [0052.448] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.448] StrStrW (lpFirst="PartnerSetupComplete.cmd", lpSrch=".wctc") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="read_me.txt") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="autoexec.bat") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="desktop.ini") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="autorun.inf") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="ntuser.dat") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="iconcache.db") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="bootsect.bak") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="boot.ini") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="ntuser.dat.log") returned 0x0 [0052.448] StrStrW (lpFirst="partnersetupcomplete.cmd", lpSrch="thumbs.db") returned 0x0 [0052.448] GetProcessHeap () returned 0x1130000 [0052.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11abf88 [0052.449] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.wctc") returned 55 [0052.449] CloseHandle (hObject=0x3b8) returned 1 [0052.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.wctc" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.wctc")) returned 1 [0052.449] GetProcessHeap () returned 0x1130000 [0052.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11abf88 | out: hHeap=0x1130000) returned 1 [0052.450] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 7 [0052.450] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0052.450] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 37 [0052.450] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch=".wctc") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="read_me.txt") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="autoexec.bat") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="desktop.ini") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="autorun.inf") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="ntuser.dat") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="iconcache.db") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="bootsect.bak") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="boot.ini") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="ntuser.dat.log") returned 0x0 [0052.451] StrStrW (lpFirst="preoobe.cmd", lpSrch="thumbs.db") returned 0x0 [0052.451] GetProcessHeap () returned 0x1130000 [0052.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11abf88 [0052.452] wnsprintfW (in: pszDest=0x11abf88, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.wctc") returned 42 [0052.452] CloseHandle (hObject=0x3b8) returned 1 [0052.452] MoveFileW (lpExistingFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.wctc" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.wctc")) returned 1 [0052.452] GetProcessHeap () returned 0x1130000 [0052.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11abf88 | out: hHeap=0x1130000) returned 1 [0052.453] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 8 [0052.453] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0052.453] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0052.453] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 43 [0052.453] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0052.454] StrStrW (lpFirst="SetupComplete.cmd", lpSrch=".wctc") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="read_me.txt") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="autoexec.bat") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="desktop.ini") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="autorun.inf") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="ntuser.dat") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="iconcache.db") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="bootsect.bak") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="boot.ini") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="ntuser.dat.log") returned 0x0 [0052.454] StrStrW (lpFirst="setupcomplete.cmd", lpSrch="thumbs.db") returned 0x0 [0052.454] GetProcessHeap () returned 0x1130000 [0052.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0052.455] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.wctc") returned 48 [0052.455] CloseHandle (hObject=0x3b8) returned 1 [0052.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.wctc" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.wctc")) returned 1 [0052.456] GetProcessHeap () returned 0x1130000 [0052.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0052.456] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 9 [0052.456] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0052.456] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0xa0000003, dwReserved1=0x753eb8cc, cFileName="setupcomplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0052.457] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0052.457] wnsprintfW (in: pszDest=0x11cbf98, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\$GetCurrent\\SafeOS\\read_me.txt") returned 37 [0052.457] GetProcessHeap () returned 0x1130000 [0052.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cbf98 | out: hHeap=0x1130000) returned 1 [0052.457] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 3 [0052.457] GetProcessHeap () returned 0x1130000 [0052.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11dbfa0 | out: hHeap=0x1130000) returned 1 [0052.458] GetProcessHeap () returned 0x1130000 [0052.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0052.458] GetProcessHeap () returned 0x1130000 [0052.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0052.458] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0052.458] GetProcessHeap () returned 0x1130000 [0052.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x1157168 [0052.458] ReadFile (in: hFile=0x3b4, lpBuffer=0x1157168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x1157168, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0052.458] GetProcessHeap () returned 0x1130000 [0052.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.458] GetProcessHeap () returned 0x1130000 [0052.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0052.458] GetProcessHeap () returned 0x1130000 [0052.458] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150af8, Size=0x20) returned 0x1175770 [0052.458] GetProcessHeap () returned 0x1130000 [0052.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11756d0 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.459] GetProcessHeap () returned 0x1130000 [0052.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177988 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177988 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0052.460] GetProcessHeap () returned 0x1130000 [0052.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.461] GetProcessHeap () returned 0x1130000 [0052.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.461] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.462] GetProcessHeap () returned 0x1130000 [0052.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0052.462] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.462] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0052.463] CloseHandle (hObject=0x3b4) returned 1 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157168 | out: hHeap=0x1130000) returned 1 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0052.463] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 0 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0052.463] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x1157168 [0052.463] ReadFile (in: hFile=0x3b4, lpBuffer=0x1157168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x1157168, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175b30 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11756d0 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.463] GetProcessHeap () returned 0x1130000 [0052.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.464] GetProcessHeap () returned 0x1130000 [0052.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0052.464] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.465] GetProcessHeap () returned 0x1130000 [0052.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.465] GetProcessHeap () returned 0x1130000 [0052.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.466] GetProcessHeap () returned 0x1130000 [0052.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.466] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0052.467] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.467] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0052.467] CloseHandle (hObject=0x3b4) returned 0 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157168 | out: hHeap=0x1130000) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0052.467] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 1 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0052.467] GetProcessHeap () returned 0x1130000 [0052.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0052.467] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x1157168 [0052.468] ReadFile (in: hFile=0x3b8, lpBuffer=0x1157168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x1157168, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b68, Size=0x20) returned 0x11756f8 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.468] GetProcessHeap () returned 0x1130000 [0052.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.469] GetProcessHeap () returned 0x1130000 [0052.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.470] GetProcessHeap () returned 0x1130000 [0052.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.470] GetProcessHeap () returned 0x1130000 [0052.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.471] GetProcessHeap () returned 0x1130000 [0052.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0052.471] GetProcessHeap () returned 0x1130000 [0052.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0052.472] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.472] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0052.472] CloseHandle (hObject=0x3b8) returned 0 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157168 | out: hHeap=0x1130000) returned 1 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0052.472] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 2 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0052.472] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x1157168 [0052.472] ReadFile (in: hFile=0x3b8, lpBuffer=0x1157168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x1157168, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175798 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175928 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.472] GetProcessHeap () returned 0x1130000 [0052.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.473] GetProcessHeap () returned 0x1130000 [0052.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0052.473] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177898 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177898 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x1175ea8 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.474] GetProcessHeap () returned 0x1130000 [0052.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.475] GetProcessHeap () returned 0x1130000 [0052.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0052.476] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.476] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0052.476] CloseHandle (hObject=0x3b8) returned 0 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157168 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0052.476] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 3 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175978 [0052.476] SystemFunction036 (in: RandomBuffer=0x1175978, RandomBufferLength=0x20 | out: RandomBuffer=0x1175978) returned 1 [0052.476] GetProcessHeap () returned 0x1130000 [0052.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x1157168 [0052.476] ReadFile (in: hFile=0x3b8, lpBuffer=0x1157168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x1157168, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175b58 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.477] GetProcessHeap () returned 0x1130000 [0052.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.477] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0052.478] GetProcessHeap () returned 0x1130000 [0052.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.479] GetProcessHeap () returned 0x1130000 [0052.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0052.480] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.480] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0052.480] CloseHandle (hObject=0x3b8) returned 0 [0052.480] GetProcessHeap () returned 0x1130000 [0052.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157168 | out: hHeap=0x1130000) returned 1 [0052.480] GetProcessHeap () returned 0x1130000 [0052.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0052.481] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 4 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0052.481] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x1157168 [0052.481] ReadFile (in: hFile=0x3b8, lpBuffer=0x1157168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x1157168, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175a68 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175b30 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0052.481] GetProcessHeap () returned 0x1130000 [0052.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0052.481] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177bf8 [0052.482] GetProcessHeap () returned 0x1130000 [0052.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0052.482] GetProcessHeap () returned 0x1130000 [0052.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177bf8 | out: hHeap=0x1130000) returned 1 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.483] GetProcessHeap () returned 0x1130000 [0052.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.631] GetProcessHeap () returned 0x1130000 [0052.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0052.632] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0052.632] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0052.632] CloseHandle (hObject=0x3b8) returned 0 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157168 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0052.632] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 9 [0052.632] GetProcessHeap () returned 0x1130000 [0052.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0052.633] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\*") returned 32 [0052.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.633] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\.") returned 32 [0052.633] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0052.633] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\..") returned 33 [0052.633] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.633] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 39 [0052.633] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0052.635] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0052.635] GetProcessHeap () returned 0x1130000 [0052.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0052.636] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.wctc") returned 44 [0052.636] CloseHandle (hObject=0x3b0) returned 1 [0052.636] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.wctc")) returned 1 [0052.638] GetProcessHeap () returned 0x1130000 [0052.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0052.638] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 10 [0052.638] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.638] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.638] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 48 [0052.638] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.639] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0052.639] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0052.639] GetProcessHeap () returned 0x1130000 [0052.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0052.639] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.wctc") returned 53 [0052.639] CloseHandle (hObject=0x3b0) returned 1 [0052.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.wctc")) returned 1 [0052.640] GetProcessHeap () returned 0x1130000 [0052.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0052.640] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 11 [0052.640] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.640] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109c789, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf109c789, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0052.640] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\read_me.txt") returned 42 [0052.640] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.640] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0052.640] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0052.640] CloseHandle (hObject=0x3b0) returned 1 [0052.640] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.640] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 49 [0052.640] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.641] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0052.641] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0052.641] GetProcessHeap () returned 0x1130000 [0052.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0052.641] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.wctc") returned 54 [0052.642] CloseHandle (hObject=0x3b0) returned 1 [0052.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.wctc")) returned 1 [0052.642] GetProcessHeap () returned 0x1130000 [0052.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0052.642] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 12 [0052.642] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.642] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.642] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.642] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1025\\read_me.txt") returned 42 [0052.642] GetProcessHeap () returned 0x1130000 [0052.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0052.643] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 4 [0052.643] GetProcessHeap () returned 0x1130000 [0052.643] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0052.643] GetProcessHeap () returned 0x1130000 [0052.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0052.644] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\*") returned 32 [0052.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.644] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\.") returned 32 [0052.644] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0052.644] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\..") returned 33 [0052.644] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.644] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 39 [0052.644] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.644] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0052.644] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0052.644] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0052.645] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0052.645] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0052.645] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0052.645] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0052.645] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0052.645] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0052.645] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0052.645] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0052.645] GetProcessHeap () returned 0x1130000 [0052.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0052.646] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.wctc") returned 44 [0052.646] CloseHandle (hObject=0x3b0) returned 1 [0052.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.wctc")) returned 1 [0052.649] GetProcessHeap () returned 0x1130000 [0052.649] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0052.649] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 13 [0052.649] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.649] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.649] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 48 [0052.649] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.650] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0052.650] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0052.650] GetProcessHeap () returned 0x1130000 [0052.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0052.650] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.wctc") returned 53 [0052.650] CloseHandle (hObject=0x3b0) returned 1 [0052.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.wctc")) returned 1 [0052.651] GetProcessHeap () returned 0x1130000 [0052.651] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0052.651] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 14 [0052.651] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.651] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109c789, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf109c789, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0052.651] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\read_me.txt") returned 42 [0052.651] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.651] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0052.651] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0052.651] CloseHandle (hObject=0x3b0) returned 1 [0052.651] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.651] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 49 [0052.651] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.652] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0052.652] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0052.652] GetProcessHeap () returned 0x1130000 [0052.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0052.652] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.wctc") returned 54 [0052.652] CloseHandle (hObject=0x3b0) returned 1 [0052.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.wctc")) returned 1 [0052.653] GetProcessHeap () returned 0x1130000 [0052.653] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0052.653] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 15 [0052.653] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.653] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.653] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.653] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1028\\read_me.txt") returned 42 [0052.653] GetProcessHeap () returned 0x1130000 [0052.653] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0052.654] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 5 [0052.654] GetProcessHeap () returned 0x1130000 [0052.654] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0052.655] GetProcessHeap () returned 0x1130000 [0052.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0052.658] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\*") returned 32 [0052.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0052.659] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\.") returned 32 [0052.659] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0052.659] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\..") returned 33 [0052.659] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.659] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 39 [0052.659] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0052.660] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0052.660] GetProcessHeap () returned 0x1130000 [0052.660] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0052.660] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.wctc") returned 44 [0052.661] CloseHandle (hObject=0x3b0) returned 1 [0052.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.wctc")) returned 1 [0052.662] GetProcessHeap () returned 0x1130000 [0052.662] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0052.662] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 16 [0052.663] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.663] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0052.663] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 48 [0052.663] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.663] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0052.663] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0052.663] GetProcessHeap () returned 0x1130000 [0052.663] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0052.664] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.wctc") returned 53 [0052.664] CloseHandle (hObject=0x3b0) returned 1 [0052.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.wctc")) returned 1 [0052.664] GetProcessHeap () returned 0x1130000 [0052.664] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0052.665] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 17 [0052.665] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.665] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109c789, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf109c789, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf109c789, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0052.665] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\read_me.txt") returned 42 [0052.665] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.665] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0052.665] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0052.665] CloseHandle (hObject=0x3b0) returned 1 [0052.665] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0052.665] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 49 [0052.665] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.665] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0052.665] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0052.665] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0052.665] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0052.665] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0052.666] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0052.666] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0052.666] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0052.666] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0052.666] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0052.666] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0052.666] GetProcessHeap () returned 0x1130000 [0052.666] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdfa8 [0052.667] wnsprintfW (in: pszDest=0x11cdfa8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.wctc") returned 54 [0052.667] CloseHandle (hObject=0x3b0) returned 1 [0052.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.wctc")) returned 1 [0052.667] GetProcessHeap () returned 0x1130000 [0052.667] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0052.667] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 18 [0052.667] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0052.667] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0052.667] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0052.668] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1029\\read_me.txt") returned 42 [0052.668] GetProcessHeap () returned 0x1130000 [0052.668] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0052.668] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 6 [0052.668] GetProcessHeap () returned 0x1130000 [0052.668] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0052.669] GetProcessHeap () returned 0x1130000 [0052.669] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0052.670] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\*") returned 32 [0052.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf10c2b32, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0052.670] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\.") returned 32 [0052.670] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf10c2b32, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0052.670] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\..") returned 33 [0052.670] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0052.670] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 39 [0052.670] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0052.671] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0052.671] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0052.671] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0052.671] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.032] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.033] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.033] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.033] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.033] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.033] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.033] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.033] GetProcessHeap () returned 0x1130000 [0053.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0053.033] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.wctc") returned 44 [0053.033] CloseHandle (hObject=0x3b0) returned 1 [0053.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.wctc")) returned 1 [0053.045] GetProcessHeap () returned 0x1130000 [0053.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0053.045] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 26 [0053.045] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0053.045] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.045] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 48 [0053.045] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.049] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.049] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.049] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.049] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.049] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.049] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.049] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.049] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.049] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.050] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.050] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.050] GetProcessHeap () returned 0x1130000 [0053.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3660088 [0053.050] wnsprintfW (in: pszDest=0x3660088, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.wctc") returned 53 [0053.050] CloseHandle (hObject=0x3b0) returned 1 [0053.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.wctc")) returned 1 [0053.052] GetProcessHeap () returned 0x1130000 [0053.052] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3660088 | out: hHeap=0x1130000) returned 1 [0053.052] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 27 [0053.052] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0053.052] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf10c2b32, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf10c2b32, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf10c2b32, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.052] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\read_me.txt") returned 42 [0053.052] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.052] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.052] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.052] CloseHandle (hObject=0x3b0) returned 1 [0053.052] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.052] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 49 [0053.052] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.058] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.058] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.058] GetProcessHeap () returned 0x1130000 [0053.058] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3670090 [0053.059] wnsprintfW (in: pszDest=0x3670090, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.wctc") returned 54 [0053.059] CloseHandle (hObject=0x3b0) returned 1 [0053.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.wctc")) returned 1 [0053.059] GetProcessHeap () returned 0x1130000 [0053.059] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3670090 | out: hHeap=0x1130000) returned 1 [0053.059] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 28 [0053.060] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0053.060] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.060] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0053.060] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1030\\read_me.txt") returned 42 [0053.060] GetProcessHeap () returned 0x1130000 [0053.060] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0053.061] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 7 [0053.061] GetProcessHeap () returned 0x1130000 [0053.061] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11edfb8 | out: hHeap=0x1130000) returned 1 [0053.061] GetProcessHeap () returned 0x1130000 [0053.061] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11edfb8 [0053.061] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\*") returned 32 [0053.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf12401d4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.061] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\.") returned 32 [0053.061] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf12401d4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.061] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\..") returned 33 [0053.061] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.061] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 39 [0053.061] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.061] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.061] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.061] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.061] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.061] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.062] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.062] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.062] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.062] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.062] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.062] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.062] GetProcessHeap () returned 0x1130000 [0053.062] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35f0050 [0053.063] wnsprintfW (in: pszDest=0x35f0050, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.wctc") returned 44 [0053.063] CloseHandle (hObject=0x3b0) returned 1 [0053.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.wctc")) returned 1 [0053.071] GetProcessHeap () returned 0x1130000 [0053.071] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0053.071] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 29 [0053.071] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0053.071] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.071] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 48 [0053.071] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.075] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.076] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.076] GetProcessHeap () returned 0x1130000 [0053.076] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.077] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.wctc") returned 53 [0053.077] CloseHandle (hObject=0x3b0) returned 1 [0053.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.wctc")) returned 1 [0053.079] GetProcessHeap () returned 0x1130000 [0053.079] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.080] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 30 [0053.080] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0053.080] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12401d4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf12401d4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf12401d4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.080] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\read_me.txt") returned 42 [0053.080] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.080] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.080] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.080] CloseHandle (hObject=0x3b0) returned 1 [0053.080] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.080] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 49 [0053.080] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0053.084] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.084] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.084] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.084] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.084] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.084] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.084] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.085] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.085] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.085] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.085] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.085] GetProcessHeap () returned 0x1130000 [0053.085] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36a00a8 [0053.086] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.wctc") returned 54 [0053.086] CloseHandle (hObject=0x3b0) returned 1 [0053.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.wctc")) returned 1 [0053.087] GetProcessHeap () returned 0x1130000 [0053.087] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36a00a8 | out: hHeap=0x1130000) returned 1 [0053.087] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 31 [0053.087] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0053.087] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x15, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.087] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.087] wnsprintfW (in: pszDest=0x11edfb8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1031\\read_me.txt") returned 42 [0053.087] GetProcessHeap () returned 0x1130000 [0053.087] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11edfb8 | out: hHeap=0x1130000) returned 1 [0053.088] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 8 [0053.088] GetProcessHeap () returned 0x1130000 [0053.088] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0053.088] GetProcessHeap () returned 0x1130000 [0053.088] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0053.088] GetProcessHeap () returned 0x1130000 [0053.088] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0053.088] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0053.088] GetProcessHeap () returned 0x1130000 [0053.088] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3697100 [0053.088] ReadFile (in: hFile=0x3b0, lpBuffer=0x3697100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x3697100, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b68, Size=0x20) returned 0x1175798 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175b08 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.089] GetProcessHeap () returned 0x1130000 [0053.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177ad8 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177ad8 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0053.090] GetProcessHeap () returned 0x1130000 [0053.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x1175ea8 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.091] GetProcessHeap () returned 0x1130000 [0053.091] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.091] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.092] GetProcessHeap () returned 0x1130000 [0053.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0053.092] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.092] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.093] CloseHandle (hObject=0x3b0) returned 0 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3697100 | out: hHeap=0x1130000) returned 1 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0053.093] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 10 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0053.093] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0053.093] ReadFile (in: hFile=0x3b0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175720 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175a40 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.093] GetProcessHeap () returned 0x1130000 [0053.093] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.093] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.094] GetProcessHeap () returned 0x1130000 [0053.094] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.095] GetProcessHeap () returned 0x1130000 [0053.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.096] GetProcessHeap () returned 0x1130000 [0053.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0053.097] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.097] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.097] CloseHandle (hObject=0x3b0) returned 0 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.097] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 11 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0053.097] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0053.097] GetProcessHeap () returned 0x1130000 [0053.097] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36900c8 [0053.097] ReadFile (in: hFile=0x3b0, lpBuffer=0x36900c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36900c8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.097] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c98, Size=0x20) returned 0x1175a18 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175b58 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.098] GetProcessHeap () returned 0x1130000 [0053.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a48 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a48 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.099] GetProcessHeap () returned 0x1130000 [0053.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.100] GetProcessHeap () returned 0x1130000 [0053.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.100] GetProcessHeap () returned 0x1130000 [0053.101] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.101] GetProcessHeap () returned 0x1130000 [0053.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0053.101] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.101] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.101] CloseHandle (hObject=0x3b0) returned 0 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36900c8 | out: hHeap=0x1130000) returned 1 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0053.102] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 12 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0053.102] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36930e0 [0053.102] ReadFile (in: hFile=0x3b0, lpBuffer=0x36930e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36930e0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175928 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175a18 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0053.102] GetProcessHeap () returned 0x1130000 [0053.102] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.103] GetProcessHeap () returned 0x1130000 [0053.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.104] GetProcessHeap () returned 0x1130000 [0053.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159178 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1175ea8 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159178 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ea8 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.105] GetProcessHeap () returned 0x1130000 [0053.105] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159178 | out: hHeap=0x1130000) returned 1 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0053.106] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.106] WriteFile (in: hFile=0x3b0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.106] CloseHandle (hObject=0x3b0) returned 0 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36930e0 | out: hHeap=0x1130000) returned 1 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.106] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 13 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0053.106] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36960f8 [0053.106] ReadFile (in: hFile=0x3b0, lpBuffer=0x36960f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36960f8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175978 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175a90 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.106] GetProcessHeap () returned 0x1130000 [0053.106] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.107] GetProcessHeap () returned 0x1130000 [0053.107] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.107] GetProcessHeap () returned 0x1130000 [0053.108] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x1159350 [0053.290] GetProcessHeap () returned 0x1130000 [0053.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.291] GetProcessHeap () returned 0x1130000 [0053.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.291] GetProcessHeap () returned 0x1130000 [0053.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1157838 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.292] GetProcessHeap () returned 0x1130000 [0053.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0053.292] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.306] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.306] CloseHandle (hObject=0x3b0) returned 1 [0053.503] GetProcessHeap () returned 0x1130000 [0053.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36960f8 | out: hHeap=0x1130000) returned 1 [0053.504] GetProcessHeap () returned 0x1130000 [0053.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0053.504] GetProcessHeap () returned 0x1130000 [0053.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0053.504] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 20 [0053.504] GetProcessHeap () returned 0x1130000 [0053.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.505] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\*") returned 32 [0053.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf12b2a7f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.505] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\.") returned 32 [0053.505] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf12b2a7f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.505] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\..") returned 33 [0053.505] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.505] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 39 [0053.505] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.505] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.505] GetProcessHeap () returned 0x1130000 [0053.505] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.506] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.wctc") returned 44 [0053.506] CloseHandle (hObject=0x3c0) returned 1 [0053.506] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.wctc")) returned 1 [0053.508] GetProcessHeap () returned 0x1130000 [0053.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.508] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 63 [0053.508] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.508] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.508] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 48 [0053.508] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.508] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.508] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.508] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.508] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.508] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.509] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.509] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.509] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.509] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.509] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.509] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.509] GetProcessHeap () returned 0x1130000 [0053.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.509] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.wctc") returned 53 [0053.509] CloseHandle (hObject=0x3c0) returned 1 [0053.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.wctc")) returned 1 [0053.509] GetProcessHeap () returned 0x1130000 [0053.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.509] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 64 [0053.509] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.509] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12b2a7f, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf12b2a7f, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf12b2a7f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.509] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\read_me.txt") returned 42 [0053.509] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.509] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.510] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.510] CloseHandle (hObject=0x3c0) returned 1 [0053.510] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.510] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 49 [0053.510] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.510] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.510] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.510] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.510] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.510] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.510] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.511] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.511] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.511] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.511] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.511] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.511] GetProcessHeap () returned 0x1130000 [0053.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.511] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.wctc") returned 54 [0053.511] CloseHandle (hObject=0x3bc) returned 1 [0053.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.wctc")) returned 1 [0053.511] GetProcessHeap () returned 0x1130000 [0053.511] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.511] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 65 [0053.511] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.511] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.511] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.512] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1038\\read_me.txt") returned 42 [0053.512] GetProcessHeap () returned 0x1130000 [0053.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.512] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 14 [0053.512] GetProcessHeap () returned 0x1130000 [0053.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0053.513] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.513] ReadFile (in: hFile=0x3bc, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x11758d8 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0053.513] GetProcessHeap () returned 0x1130000 [0053.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.513] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.514] GetProcessHeap () returned 0x1130000 [0053.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.514] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.515] GetProcessHeap () returned 0x1130000 [0053.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.515] GetProcessHeap () returned 0x1130000 [0053.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.516] GetProcessHeap () returned 0x1130000 [0053.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.516] GetProcessHeap () returned 0x1130000 [0053.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121dfd0 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0053.517] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.517] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.517] CloseHandle (hObject=0x3bc) returned 0 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0053.517] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 21 [0053.517] GetProcessHeap () returned 0x1130000 [0053.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.518] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\*") returned 32 [0053.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15ad9ba, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0053.518] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\.") returned 32 [0053.518] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15ad9ba, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.518] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\..") returned 33 [0053.518] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.518] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 39 [0053.519] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.519] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.520] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.520] GetProcessHeap () returned 0x1130000 [0053.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.520] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.wctc") returned 44 [0053.520] CloseHandle (hObject=0x3bc) returned 1 [0053.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.wctc")) returned 1 [0053.524] GetProcessHeap () returned 0x1130000 [0053.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.524] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 66 [0053.524] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.524] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.524] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 48 [0053.525] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.525] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.525] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.525] GetProcessHeap () returned 0x1130000 [0053.525] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.525] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.wctc") returned 53 [0053.525] CloseHandle (hObject=0x3bc) returned 1 [0053.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.wctc")) returned 1 [0053.526] GetProcessHeap () returned 0x1130000 [0053.526] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.526] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 67 [0053.526] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.526] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15ad9ba, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf15ad9ba, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf15ad9ba, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.526] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\read_me.txt") returned 42 [0053.526] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.526] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.526] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.526] CloseHandle (hObject=0x3bc) returned 1 [0053.526] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.526] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 49 [0053.526] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.527] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.527] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.527] GetProcessHeap () returned 0x1130000 [0053.527] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.527] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.wctc") returned 54 [0053.527] CloseHandle (hObject=0x3bc) returned 1 [0053.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.wctc")) returned 1 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.528] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 68 [0053.528] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.528] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.528] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0053.528] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1040\\read_me.txt") returned 42 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.528] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 15 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3620068 | out: hHeap=0x1130000) returned 1 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0053.528] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.528] ReadFile (in: hFile=0x3bc, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175720 [0053.528] GetProcessHeap () returned 0x1130000 [0053.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0053.528] GetProcessHeap () returned 0x1130000 [0053.529] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175a90 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.529] GetProcessHeap () returned 0x1130000 [0053.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177ad8 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177ad8 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0053.530] GetProcessHeap () returned 0x1130000 [0053.530] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0053.530] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.531] GetProcessHeap () returned 0x1130000 [0053.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121dfd0 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.532] GetProcessHeap () returned 0x1130000 [0053.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0053.532] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.533] WriteFile (in: hFile=0x3bc, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.533] CloseHandle (hObject=0x3bc) returned 0 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.533] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 22 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0053.533] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.533] ReadFile (in: hFile=0x3bc, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175860 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175798 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.533] GetProcessHeap () returned 0x1130000 [0053.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0053.533] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.534] GetProcessHeap () returned 0x1130000 [0053.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b38 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b38 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.535] GetProcessHeap () returned 0x1130000 [0053.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.536] GetProcessHeap () returned 0x1130000 [0053.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121dfd0 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0053.537] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.537] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.537] CloseHandle (hObject=0x3bc) returned 0 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0053.537] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 23 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0053.537] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0053.537] GetProcessHeap () returned 0x1130000 [0053.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.537] ReadFile (in: hFile=0x3bc, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.537] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175ba8 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.538] GetProcessHeap () returned 0x1130000 [0053.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.538] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779b8 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779b8 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0053.539] GetProcessHeap () returned 0x1130000 [0053.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.540] GetProcessHeap () returned 0x1130000 [0053.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.540] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121dfd0 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121dfd0 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121dfd0 | out: hHeap=0x1130000) returned 1 [0053.541] GetProcessHeap () returned 0x1130000 [0053.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0053.541] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.541] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0053.542] CloseHandle (hObject=0x3bc) returned 0 [0053.542] GetProcessHeap () returned 0x1130000 [0053.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0053.542] GetProcessHeap () returned 0x1130000 [0053.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0053.542] GetProcessHeap () returned 0x1130000 [0053.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.542] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 24 [0053.542] GetProcessHeap () returned 0x1130000 [0053.542] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3620068 [0053.542] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\*") returned 32 [0053.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15ad9ba, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0053.542] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\.") returned 32 [0053.542] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15ad9ba, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.542] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\..") returned 33 [0053.542] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.542] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 39 [0053.542] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.542] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.542] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.542] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.542] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.542] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.542] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.543] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.543] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.543] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.543] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.543] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.543] GetProcessHeap () returned 0x1130000 [0053.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.543] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.wctc") returned 44 [0053.543] CloseHandle (hObject=0x3bc) returned 1 [0053.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.wctc")) returned 1 [0053.755] GetProcessHeap () returned 0x1130000 [0053.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.755] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 87 [0053.755] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.755] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.755] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 48 [0053.755] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.755] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.755] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.755] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.755] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.755] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.755] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.755] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.755] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.755] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.756] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.756] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.756] GetProcessHeap () returned 0x1130000 [0053.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.756] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.wctc") returned 53 [0053.756] CloseHandle (hObject=0x3bc) returned 1 [0053.756] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.wctc")) returned 1 [0053.756] GetProcessHeap () returned 0x1130000 [0053.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.756] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 88 [0053.756] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15ad9ba, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf15ad9ba, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf15d3b81, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.756] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\read_me.txt") returned 42 [0053.756] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.756] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.756] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.756] CloseHandle (hObject=0x3bc) returned 1 [0053.757] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.757] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 49 [0053.757] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.757] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.757] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.757] GetProcessHeap () returned 0x1130000 [0053.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.757] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.wctc") returned 54 [0053.757] CloseHandle (hObject=0x3bc) returned 1 [0053.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.wctc")) returned 1 [0053.758] GetProcessHeap () returned 0x1130000 [0053.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.758] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 89 [0053.758] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.758] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.758] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0053.758] wnsprintfW (in: pszDest=0x3620068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1041\\read_me.txt") returned 42 [0053.758] GetProcessHeap () returned 0x1130000 [0053.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3620068 | out: hHeap=0x1130000) returned 1 [0053.758] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 22 [0053.758] GetProcessHeap () returned 0x1130000 [0053.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0053.760] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0053.760] ReadFile (in: hFile=0x3b4, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175770 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.760] GetProcessHeap () returned 0x1130000 [0053.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.761] GetProcessHeap () returned 0x1130000 [0053.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.761] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.762] GetProcessHeap () returned 0x1130000 [0053.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.762] GetProcessHeap () returned 0x1130000 [0053.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.763] GetProcessHeap () returned 0x1130000 [0053.763] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11bdc58 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0053.764] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.252] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0054.258] CloseHandle (hObject=0x3b4) returned 0 [0054.258] GetProcessHeap () returned 0x1130000 [0054.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0054.258] GetProcessHeap () returned 0x1130000 [0054.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0054.259] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 32 [0055.083] GetProcessHeap () returned 0x1130000 [0055.083] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0055.083] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\*") returned 19 [0055.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf18ce7ff, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1151858, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0055.083] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\.") returned 19 [0055.083] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf18ce7ff, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1151858, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.083] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\..") returned 20 [0055.083] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x1151858, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.083] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 33 [0055.083] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.083] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x1151858, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0055.083] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui") returned 33 [0055.083] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.083] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18ce7ff, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18ce7ff, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18ce7ff, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x1151858, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.084] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\read_me.txt") returned 29 [0055.084] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\read_me.txt" (normalized: "c:\\boot\\da-dk\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0055.084] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.084] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.084] CloseHandle (hObject=0x3c0) returned 1 [0055.084] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18ce7ff, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18ce7ff, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18ce7ff, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x1151858, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.084] FindClose (in: hFindFile=0x1170ba0 | out: hFindFile=0x1170ba0) returned 1 [0055.164] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\read_me.txt") returned 29 [0055.164] GetProcessHeap () returned 0x1130000 [0055.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0055.164] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 35 [0055.164] GetProcessHeap () returned 0x1130000 [0055.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3800058 | out: hHeap=0x1130000) returned 1 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0055.563] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.563] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175a18 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175ba8 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.563] GetProcessHeap () returned 0x1130000 [0055.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.563] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.564] GetProcessHeap () returned 0x1130000 [0055.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.564] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.565] GetProcessHeap () returned 0x1130000 [0055.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.566] GetProcessHeap () returned 0x1130000 [0055.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.567] GetProcessHeap () returned 0x1130000 [0055.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.567] GetProcessHeap () returned 0x1130000 [0055.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.567] GetProcessHeap () returned 0x1130000 [0055.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0055.567] GetProcessHeap () returned 0x1130000 [0055.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.567] GetProcessHeap () returned 0x1130000 [0055.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0055.567] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.567] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0055.567] CloseHandle (hObject=0x3c0) returned 1 [0055.567] GetProcessHeap () returned 0x1130000 [0055.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.567] GetProcessHeap () returned 0x1130000 [0055.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0055.567] GetProcessHeap () returned 0x1130000 [0055.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0055.567] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 59 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0055.824] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0055.824] ReadFile (in: hFile=0x3b4, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175860 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175b08 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.824] GetProcessHeap () returned 0x1130000 [0055.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.825] GetProcessHeap () returned 0x1130000 [0055.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e8a8 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.826] GetProcessHeap () returned 0x1130000 [0055.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e8a8 | out: hHeap=0x1130000) returned 1 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e8a8 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e8a8 | out: hHeap=0x1130000) returned 1 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e8a8 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e8a8 | out: hHeap=0x1130000) returned 1 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e8a8 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e8a8 | out: hHeap=0x1130000) returned 1 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e8a8 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.827] GetProcessHeap () returned 0x1130000 [0055.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e8a8 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e8a8 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e8a8 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e8a8 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e8a8 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.828] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.828] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0055.828] CloseHandle (hObject=0x3b4) returned 0 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0055.828] GetProcessHeap () returned 0x1130000 [0055.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.828] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 78 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a90 [0056.149] SystemFunction036 (in: RandomBuffer=0x1175a90, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a90) returned 1 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x369b120 [0056.149] ReadFile (in: hFile=0x3b8, lpBuffer=0x369b120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x369b120, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c98, Size=0x20) returned 0x11759a0 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175ae0 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.149] GetProcessHeap () returned 0x1130000 [0056.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.149] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.150] GetProcessHeap () returned 0x1130000 [0056.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177aa8 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e520 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177aa8 | out: hHeap=0x1130000) returned 1 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e520 | out: hHeap=0x1130000) returned 1 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c30d0 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c30d0 | out: hHeap=0x1130000) returned 1 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c30d0 [0056.151] GetProcessHeap () returned 0x1130000 [0056.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c30d0 | out: hHeap=0x1130000) returned 1 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c30d0 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c30d0 | out: hHeap=0x1130000) returned 1 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c30d0 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c30d0 | out: hHeap=0x1130000) returned 1 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c30d0 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c30d0 | out: hHeap=0x1130000) returned 1 [0056.152] GetProcessHeap () returned 0x1130000 [0056.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c30d0 [0056.152] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c30d0 | out: hHeap=0x1130000) returned 1 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x36c30d0 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c30d0 | out: hHeap=0x1130000) returned 1 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0056.153] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.153] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0056.153] CloseHandle (hObject=0x3b8) returned 0 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x369b120 | out: hHeap=0x1130000) returned 1 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0056.153] GetProcessHeap () returned 0x1130000 [0056.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0056.153] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 93 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0056.302] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.302] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175950 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175798 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.302] GetProcessHeap () returned 0x1130000 [0056.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.303] GetProcessHeap () returned 0x1130000 [0056.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.303] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156160 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156368 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156160 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156368 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156368 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.304] GetProcessHeap () returned 0x1130000 [0056.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156160 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156368 | out: hHeap=0x1130000) returned 1 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156368 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156160 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156368 | out: hHeap=0x1130000) returned 1 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156368 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156160 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156368 | out: hHeap=0x1130000) returned 1 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156368 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156160 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156368 | out: hHeap=0x1130000) returned 1 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156368 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.305] GetProcessHeap () returned 0x1130000 [0056.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156160 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156368 | out: hHeap=0x1130000) returned 1 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1156368 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156368 | out: hHeap=0x1130000) returned 1 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0056.306] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.306] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0056.306] CloseHandle (hObject=0x3c0) returned 0 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.306] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 110 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0056.481] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.481] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175b30 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.481] GetProcessHeap () returned 0x1130000 [0056.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.482] GetProcessHeap () returned 0x1130000 [0056.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.483] GetProcessHeap () returned 0x1130000 [0056.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.484] GetProcessHeap () returned 0x1130000 [0056.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x38900a0 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.485] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.485] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0056.485] CloseHandle (hObject=0x3c0) returned 0 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0056.485] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 123 [0056.579] GetProcessHeap () returned 0x1130000 [0056.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.579] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\PerfLogs\\*") returned 17 [0056.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2a641a5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.580] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\.") returned 17 [0056.580] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2a641a5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.580] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\..") returned 18 [0056.580] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a641a5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2a641a5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a641a5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.580] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\read_me.txt") returned 27 [0056.580] CreateFileW (lpFileName="\\\\?\\C:\\PerfLogs\\read_me.txt" (normalized: "c:\\perflogs\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.580] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.580] GetProcessHeap () returned 0x1130000 [0056.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.580] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 77 [0056.580] GetProcessHeap () returned 0x1130000 [0056.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.667] GetProcessHeap () returned 0x1130000 [0056.667] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.679] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\System Volume Information\\*") returned 34 [0056.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\System Volume Information\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a641a5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2a641a5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a641a5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0056.679] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\System Volume Information\\read_me.txt") returned 44 [0056.679] GetProcessHeap () returned 0x1130000 [0056.679] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.679] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 80 [0056.679] GetProcessHeap () returned 0x1130000 [0056.679] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0056.917] GetProcessHeap () returned 0x1130000 [0056.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0056.917] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\*") returned 50 [0056.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a6d1c0, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x752eb60, ftLastAccessTime.dwHighDateTime=0x1d4c613, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.918] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\.") returned 50 [0056.918] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a6d1c0, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x752eb60, ftLastAccessTime.dwHighDateTime=0x1d4c613, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.918] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\..") returned 51 [0056.918] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a486f40, ftCreationTime.dwHighDateTime=0x1d4d222, ftLastAccessTime.dwLowDateTime=0xbb058700, ftLastAccessTime.dwHighDateTime=0x1d4ceae, ftLastWriteTime.dwLowDateTime=0xbb058700, ftLastWriteTime.dwHighDateTime=0x1d4ceae, nFileSizeHigh=0x0, nFileSizeLow=0x1fae, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="014myqLS4eop.ppt", cAlternateFileName="014MYQ~1.PPT")) returned 1 [0056.918] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\014myqLS4eop.ppt") returned 65 [0056.918] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\014myqLS4eop.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\014myqls4eop.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.918] StrStrW (lpFirst="014myqLS4eop.ppt", lpSrch=".wctc") returned 0x0 [0056.918] GetProcessHeap () returned 0x1130000 [0056.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.919] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\014myqLS4eop.ppt.wctc") returned 70 [0056.919] CloseHandle (hObject=0x3b0) returned 1 [0056.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\014myqLS4eop.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\014myqls4eop.ppt"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\014myqLS4eop.ppt.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\014myqls4eop.ppt.wctc")) returned 1 [0056.942] GetProcessHeap () returned 0x1130000 [0056.942] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.942] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 240 [0056.942] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.942] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf04300, ftCreationTime.dwHighDateTime=0x1d4c9cd, ftLastAccessTime.dwLowDateTime=0xe8cb19b0, ftLastAccessTime.dwHighDateTime=0x1d4c978, ftLastWriteTime.dwLowDateTime=0xe8cb19b0, ftLastWriteTime.dwHighDateTime=0x1d4c978, nFileSizeHigh=0x0, nFileSizeLow=0x15a68, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="6b s8ZZ6M.gif", cAlternateFileName="6BS8ZZ~1.GIF")) returned 1 [0056.942] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\6b s8ZZ6M.gif") returned 62 [0056.942] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\6b s8ZZ6M.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\6b s8zz6m.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.942] StrStrW (lpFirst="6b s8ZZ6M.gif", lpSrch=".wctc") returned 0x0 [0056.942] GetProcessHeap () returned 0x1130000 [0056.942] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.942] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\6b s8ZZ6M.gif.wctc") returned 67 [0056.942] CloseHandle (hObject=0x3b0) returned 1 [0056.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\6b s8ZZ6M.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\6b s8zz6m.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\6b s8ZZ6M.gif.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\6b s8zz6m.gif.wctc")) returned 1 [0056.943] GetProcessHeap () returned 0x1130000 [0056.943] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.943] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 241 [0056.943] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.943] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6c8ad0, ftCreationTime.dwHighDateTime=0x1d4ca86, ftLastAccessTime.dwLowDateTime=0x89481df0, ftLastAccessTime.dwHighDateTime=0x1d4ce99, ftLastWriteTime.dwLowDateTime=0x89481df0, ftLastWriteTime.dwHighDateTime=0x1d4ce99, nFileSizeHigh=0x0, nFileSizeLow=0x8bac, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="CGs1U.swf", cAlternateFileName="")) returned 1 [0056.943] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\CGs1U.swf") returned 58 [0056.943] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\CGs1U.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\cgs1u.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.943] StrStrW (lpFirst="CGs1U.swf", lpSrch=".wctc") returned 0x0 [0056.943] GetProcessHeap () returned 0x1130000 [0056.943] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.943] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\CGs1U.swf.wctc") returned 63 [0056.943] CloseHandle (hObject=0x3b0) returned 1 [0056.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\CGs1U.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\cgs1u.swf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\CGs1U.swf.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\cgs1u.swf.wctc")) returned 1 [0056.944] GetProcessHeap () returned 0x1130000 [0056.944] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.944] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 242 [0056.944] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.944] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6c2670, ftCreationTime.dwHighDateTime=0x1d4d31e, ftLastAccessTime.dwLowDateTime=0x1759f3f0, ftLastAccessTime.dwHighDateTime=0x1d4cec4, ftLastWriteTime.dwLowDateTime=0x1759f3f0, ftLastWriteTime.dwHighDateTime=0x1d4cec4, nFileSizeHigh=0x0, nFileSizeLow=0x9ce9, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="DhUNR3-1aSsxSQ0hqR1C.swf", cAlternateFileName="DHUNR3~1.SWF")) returned 1 [0056.944] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\DhUNR3-1aSsxSQ0hqR1C.swf") returned 73 [0056.944] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\DhUNR3-1aSsxSQ0hqR1C.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\dhunr3-1assxsq0hqr1c.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.944] StrStrW (lpFirst="DhUNR3-1aSsxSQ0hqR1C.swf", lpSrch=".wctc") returned 0x0 [0056.944] GetProcessHeap () returned 0x1130000 [0056.944] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.944] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\DhUNR3-1aSsxSQ0hqR1C.swf.wctc") returned 78 [0056.944] CloseHandle (hObject=0x3b0) returned 1 [0056.944] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\DhUNR3-1aSsxSQ0hqR1C.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\dhunr3-1assxsq0hqr1c.swf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\DhUNR3-1aSsxSQ0hqR1C.swf.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\dhunr3-1assxsq0hqr1c.swf.wctc")) returned 1 [0056.944] GetProcessHeap () returned 0x1130000 [0056.944] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.944] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 243 [0056.945] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.945] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ef3770, ftCreationTime.dwHighDateTime=0x1d4c61e, ftLastAccessTime.dwLowDateTime=0x81652250, ftLastAccessTime.dwHighDateTime=0x1d4cbcd, ftLastWriteTime.dwLowDateTime=0x81652250, ftLastWriteTime.dwHighDateTime=0x1d4cbcd, nFileSizeHigh=0x0, nFileSizeLow=0x15183, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="qE0dQtq35AAmBLz.mp4", cAlternateFileName="QE0DQT~1.MP4")) returned 1 [0056.945] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\qE0dQtq35AAmBLz.mp4") returned 68 [0056.945] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\qE0dQtq35AAmBLz.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\qe0dqtq35aamblz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.945] StrStrW (lpFirst="qE0dQtq35AAmBLz.mp4", lpSrch=".wctc") returned 0x0 [0056.945] GetProcessHeap () returned 0x1130000 [0056.945] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.945] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\qE0dQtq35AAmBLz.mp4.wctc") returned 73 [0056.945] CloseHandle (hObject=0x3b0) returned 1 [0056.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\qE0dQtq35AAmBLz.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\qe0dqtq35aamblz.mp4"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\qE0dQtq35AAmBLz.mp4.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\qe0dqtq35aamblz.mp4.wctc")) returned 1 [0056.945] GetProcessHeap () returned 0x1130000 [0056.945] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.945] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 244 [0056.945] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.945] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d38be2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.945] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\read_me.txt") returned 60 [0056.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.946] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.946] GetProcessHeap () returned 0x1130000 [0056.946] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.946] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\s83AqP92.flv.wctc") returned 66 [0056.946] CloseHandle (hObject=0x3b0) returned 1 [0056.946] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\s83AqP92.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\s83aqp92.flv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\s83AqP92.flv.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\s83aqp92.flv.wctc")) returned 1 [0056.946] GetProcessHeap () returned 0x1130000 [0056.946] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.946] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 245 [0056.946] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.946] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ad8360, ftCreationTime.dwHighDateTime=0x1d4cd13, ftLastAccessTime.dwLowDateTime=0xb38b3760, ftLastAccessTime.dwHighDateTime=0x1d4d1b8, ftLastWriteTime.dwLowDateTime=0xb38b3760, ftLastWriteTime.dwHighDateTime=0x1d4d1b8, nFileSizeHigh=0x0, nFileSizeLow=0xaf6e, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="WfjTOA0VEwuor.bmp", cAlternateFileName="WFJTOA~1.BMP")) returned 1 [0056.946] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\WfjTOA0VEwuor.bmp") returned 66 [0056.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\WfjTOA0VEwuor.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\wfjtoa0vewuor.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.947] StrStrW (lpFirst="WfjTOA0VEwuor.bmp", lpSrch=".wctc") returned 0x0 [0056.947] GetProcessHeap () returned 0x1130000 [0056.947] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.947] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\WfjTOA0VEwuor.bmp.wctc") returned 71 [0056.947] CloseHandle (hObject=0x3b0) returned 1 [0056.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\WfjTOA0VEwuor.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\wfjtoa0vewuor.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\WfjTOA0VEwuor.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\wfjtoa0vewuor.bmp.wctc")) returned 1 [0056.948] GetProcessHeap () returned 0x1130000 [0056.948] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.948] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 246 [0056.948] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.948] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56585400, ftCreationTime.dwHighDateTime=0x1d4d074, ftLastAccessTime.dwLowDateTime=0x4156ee0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x4156ee0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0xa3d0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="xRweDAvtYybIykwOmefx.gif", cAlternateFileName="XRWEDA~1.GIF")) returned 1 [0056.948] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\xRweDAvtYybIykwOmefx.gif") returned 73 [0056.948] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\xRweDAvtYybIykwOmefx.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\xrwedavtyybiykwomefx.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.948] StrStrW (lpFirst="xRweDAvtYybIykwOmefx.gif", lpSrch=".wctc") returned 0x0 [0056.948] GetProcessHeap () returned 0x1130000 [0056.948] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.948] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\xRweDAvtYybIykwOmefx.gif.wctc") returned 78 [0056.948] CloseHandle (hObject=0x3b0) returned 1 [0056.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\xRweDAvtYybIykwOmefx.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\xrwedavtyybiykwomefx.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\xRweDAvtYybIykwOmefx.gif.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\cjy 1rg4itb4tjezx-vr\\xrwedavtyybiykwomefx.gif.wctc")) returned 1 [0056.949] GetProcessHeap () returned 0x1130000 [0056.949] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.949] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 247 [0056.949] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.949] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56585400, ftCreationTime.dwHighDateTime=0x1d4d074, ftLastAccessTime.dwLowDateTime=0x4156ee0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x4156ee0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0xa3d0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="xrwedavtyybiykwomefx.gif", cAlternateFileName="XRWEDA~1.GIF")) returned 0 [0056.949] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.949] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR\\read_me.txt") returned 60 [0056.949] GetProcessHeap () returned 0x1130000 [0056.949] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0056.949] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 112 [0056.949] GetProcessHeap () returned 0x1130000 [0056.949] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d70110 | out: hHeap=0x1130000) returned 1 [0056.999] GetProcessHeap () returned 0x1130000 [0056.999] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d90120 [0056.999] wnsprintfW (in: pszDest=0x3d90120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures\\*") returned 43 [0056.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56585400, ftCreationTime.dwHighDateTime=0x1d4d074, ftLastAccessTime.dwLowDateTime=0x4156ee0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x4156ee0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0xa3d0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="xrwedavtyybiykwomefx.gif", cAlternateFileName="")) returned 0xffffffff [0056.999] wnsprintfW (in: pszDest=0x3d90120, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures\\read_me.txt") returned 53 [0056.999] GetProcessHeap () returned 0x1130000 [0056.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d90120 | out: hHeap=0x1130000) returned 1 [0056.999] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 115 [0057.000] GetProcessHeap () returned 0x1130000 [0057.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3da0128 | out: hHeap=0x1130000) returned 1 [0057.113] GetProcessHeap () returned 0x1130000 [0057.113] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.114] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links\\*") returned 37 [0057.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.114] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links\\.") returned 37 [0057.114] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.114] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links\\..") returned 38 [0057.114] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.114] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned 47 [0057.114] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0057.115] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.115] GetProcessHeap () returned 0x1130000 [0057.115] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.115] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 131 [0057.115] GetProcessHeap () returned 0x1130000 [0057.115] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ea01a8 | out: hHeap=0x1130000) returned 1 [0057.335] GetProcessHeap () returned 0x1130000 [0057.335] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.336] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\My Documents\\*") returned 34 [0057.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb667b, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fb667b, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0057.336] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\My Documents\\read_me.txt") returned 44 [0057.336] GetProcessHeap () returned 0x1130000 [0057.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.336] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 144 [0057.336] GetProcessHeap () returned 0x1130000 [0057.337] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ed01c0 | out: hHeap=0x1130000) returned 1 [0057.414] GetProcessHeap () returned 0x1130000 [0057.414] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.418] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\SendTo\\*") returned 28 [0057.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb667b, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fb667b, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0057.419] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\SendTo\\read_me.txt") returned 38 [0057.419] GetProcessHeap () returned 0x1130000 [0057.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.419] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 155 [0057.419] GetProcessHeap () returned 0x1130000 [0057.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fb1238 | out: hHeap=0x1130000) returned 1 [0057.421] GetProcessHeap () returned 0x1130000 [0057.421] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.421] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Start Menu\\*") returned 32 [0057.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb667b, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fb667b, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0057.421] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Start Menu\\read_me.txt") returned 42 [0057.421] GetProcessHeap () returned 0x1130000 [0057.422] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.422] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 156 [0057.422] GetProcessHeap () returned 0x1130000 [0057.422] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fc1240 | out: hHeap=0x1130000) returned 1 [0057.422] GetProcessHeap () returned 0x1130000 [0057.422] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.422] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Templates\\*") returned 31 [0057.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb667b, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fb667b, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0057.423] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Templates\\read_me.txt") returned 41 [0057.423] GetProcessHeap () returned 0x1130000 [0057.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.423] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 157 [0057.423] GetProcessHeap () returned 0x1130000 [0057.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.424] GetProcessHeap () returned 0x1130000 [0057.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3fe0048 [0057.425] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\*") returned 28 [0057.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2e43d66, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.425] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\.") returned 28 [0057.425] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2e43d66, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.425] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\..") returned 29 [0057.425] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80132130, ftCreationTime.dwHighDateTime=0x1d4d1ff, ftLastAccessTime.dwLowDateTime=0x8a0a25c0, ftLastAccessTime.dwHighDateTime=0x1d4d2c8, ftLastWriteTime.dwLowDateTime=0x8a0a25c0, ftLastWriteTime.dwHighDateTime=0x1d4d2c8, nFileSizeHigh=0x0, nFileSizeLow=0x15d4d, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="6TNcCGqx_wMA.swf", cAlternateFileName="6TNCCG~1.SWF")) returned 1 [0057.425] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\6TNcCGqx_wMA.swf") returned 43 [0057.425] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\6TNcCGqx_wMA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\6tnccgqx_wma.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.426] StrStrW (lpFirst="6TNcCGqx_wMA.swf", lpSrch=".wctc") returned 0x0 [0057.426] GetProcessHeap () returned 0x1130000 [0057.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.426] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\6TNcCGqx_wMA.swf.wctc") returned 48 [0057.426] CloseHandle (hObject=0x3c0) returned 1 [0057.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\6TNcCGqx_wMA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\6tnccgqx_wma.swf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\6TNcCGqx_wMA.swf.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\6tnccgqx_wma.swf.wctc")) returned 1 [0057.427] GetProcessHeap () returned 0x1130000 [0057.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.427] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 405 [0057.427] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.427] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd72f6150, ftCreationTime.dwHighDateTime=0x1d4c920, ftLastAccessTime.dwLowDateTime=0xa425aaf0, ftLastAccessTime.dwHighDateTime=0x1d4d247, ftLastWriteTime.dwLowDateTime=0xa425aaf0, ftLastWriteTime.dwHighDateTime=0x1d4d247, nFileSizeHigh=0x0, nFileSizeLow=0x16097, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="axqH2FVENbekcuqlixq.flv", cAlternateFileName="AXQH2F~1.FLV")) returned 1 [0057.427] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\axqH2FVENbekcuqlixq.flv") returned 50 [0057.427] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\axqH2FVENbekcuqlixq.flv" (normalized: "c:\\users\\fd1hvy\\videos\\axqh2fvenbekcuqlixq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.427] StrStrW (lpFirst="axqH2FVENbekcuqlixq.flv", lpSrch=".wctc") returned 0x0 [0057.427] GetProcessHeap () returned 0x1130000 [0057.427] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.427] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\axqH2FVENbekcuqlixq.flv.wctc") returned 55 [0057.427] CloseHandle (hObject=0x3c0) returned 1 [0057.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\axqH2FVENbekcuqlixq.flv" (normalized: "c:\\users\\fd1hvy\\videos\\axqh2fvenbekcuqlixq.flv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\axqH2FVENbekcuqlixq.flv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\axqh2fvenbekcuqlixq.flv.wctc")) returned 1 [0057.428] GetProcessHeap () returned 0x1130000 [0057.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.428] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 406 [0057.428] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.428] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.428] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned 38 [0057.428] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.428] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.428] GetProcessHeap () returned 0x1130000 [0057.428] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.428] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\ssAI28zsZnypSH.swf.wctc") returned 50 [0057.428] CloseHandle (hObject=0x3c0) returned 1 [0057.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\ssAI28zsZnypSH.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ssai28zsznypsh.swf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\ssAI28zsZnypSH.swf.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\ssai28zsznypsh.swf.wctc")) returned 1 [0057.429] GetProcessHeap () returned 0x1130000 [0057.429] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.429] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 407 [0057.429] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.429] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81335ed0, ftCreationTime.dwHighDateTime=0x1d4d26e, ftLastAccessTime.dwLowDateTime=0x43b5f130, ftLastAccessTime.dwHighDateTime=0x1d4d1b5, ftLastWriteTime.dwLowDateTime=0x43b5f130, ftLastWriteTime.dwHighDateTime=0x1d4d1b5, nFileSizeHigh=0x0, nFileSizeLow=0x1243e, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="TDmgRHYmSaloTdz7MJ.mkv", cAlternateFileName="TDMGRH~1.MKV")) returned 1 [0057.429] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\TDmgRHYmSaloTdz7MJ.mkv") returned 49 [0057.429] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\TDmgRHYmSaloTdz7MJ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\tdmgrhymsalotdz7mj.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.429] StrStrW (lpFirst="TDmgRHYmSaloTdz7MJ.mkv", lpSrch=".wctc") returned 0x0 [0057.429] GetProcessHeap () returned 0x1130000 [0057.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.429] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\TDmgRHYmSaloTdz7MJ.mkv.wctc") returned 54 [0057.429] CloseHandle (hObject=0x3c0) returned 1 [0057.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\TDmgRHYmSaloTdz7MJ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\tdmgrhymsalotdz7mj.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\TDmgRHYmSaloTdz7MJ.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\tdmgrhymsalotdz7mj.mkv.wctc")) returned 1 [0057.430] GetProcessHeap () returned 0x1130000 [0057.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.430] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 408 [0057.430] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.430] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde0e4df0, ftCreationTime.dwHighDateTime=0x1d4c8cc, ftLastAccessTime.dwLowDateTime=0x35611a70, ftLastAccessTime.dwHighDateTime=0x1d4ca8e, ftLastWriteTime.dwLowDateTime=0x35611a70, ftLastWriteTime.dwHighDateTime=0x1d4ca8e, nFileSizeHigh=0x0, nFileSizeLow=0x12af4, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="WCVv.mkv", cAlternateFileName="")) returned 1 [0057.430] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\WCVv.mkv") returned 35 [0057.430] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\WCVv.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\wcvv.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.430] StrStrW (lpFirst="WCVv.mkv", lpSrch=".wctc") returned 0x0 [0057.430] GetProcessHeap () returned 0x1130000 [0057.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.430] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\WCVv.mkv.wctc") returned 40 [0057.430] CloseHandle (hObject=0x3c0) returned 1 [0057.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\WCVv.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\wcvv.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\WCVv.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\wcvv.mkv.wctc")) returned 1 [0057.430] GetProcessHeap () returned 0x1130000 [0057.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.430] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 409 [0057.430] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.430] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b5386c0, ftCreationTime.dwHighDateTime=0x1d4cd04, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="x89rl", cAlternateFileName="")) returned 1 [0057.430] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl") returned 32 [0057.431] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7398ab0, ftCreationTime.dwHighDateTime=0x1d4cc66, ftLastAccessTime.dwLowDateTime=0xa22575c0, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0xa22575c0, ftLastWriteTime.dwHighDateTime=0x1d4ca52, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="Y00L86e893nr", cAlternateFileName="Y00L86~1")) returned 1 [0057.431] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr") returned 39 [0057.431] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825881f0, ftCreationTime.dwHighDateTime=0x1d4c7ba, ftLastAccessTime.dwLowDateTime=0x835da5c0, ftLastAccessTime.dwHighDateTime=0x1d4cfe5, ftLastWriteTime.dwLowDateTime=0x835da5c0, ftLastWriteTime.dwHighDateTime=0x1d4cfe5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="YcteYZ3k e_kH_NYjCi", cAlternateFileName="YCTEYZ~1")) returned 1 [0057.431] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi") returned 46 [0057.431] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825881f0, ftCreationTime.dwHighDateTime=0x1d4c7ba, ftLastAccessTime.dwLowDateTime=0x835da5c0, ftLastAccessTime.dwHighDateTime=0x1d4cfe5, ftLastWriteTime.dwLowDateTime=0x835da5c0, ftLastWriteTime.dwHighDateTime=0x1d4cfe5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="YcteYZ3k e_kH_NYjCi", cAlternateFileName="YCTEYZ~1")) returned 0 [0057.431] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0057.431] wnsprintfW (in: pszDest=0x3fe0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\read_me.txt") returned 38 [0057.431] GetProcessHeap () returned 0x1130000 [0057.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.432] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 158 [0057.432] GetProcessHeap () returned 0x1130000 [0057.432] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ff0050 | out: hHeap=0x1130000) returned 1 [0057.432] GetProcessHeap () returned 0x1130000 [0057.432] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.433] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\*") returned 34 [0057.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b5386c0, ftCreationTime.dwHighDateTime=0x1d4cd04, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.433] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\.") returned 34 [0057.433] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b5386c0, ftCreationTime.dwHighDateTime=0x1d4cd04, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.433] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\..") returned 35 [0057.433] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1d3840, ftCreationTime.dwHighDateTime=0x1d4c6e5, ftLastAccessTime.dwLowDateTime=0xee022270, ftLastAccessTime.dwHighDateTime=0x1d4d387, ftLastWriteTime.dwLowDateTime=0xee022270, ftLastWriteTime.dwHighDateTime=0x1d4d387, nFileSizeHigh=0x0, nFileSizeLow=0x8f5b, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="cVv2z.avi", cAlternateFileName="")) returned 1 [0057.433] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\cVv2z.avi") returned 42 [0057.433] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\cVv2z.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\cvv2z.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.433] StrStrW (lpFirst="cVv2z.avi", lpSrch=".wctc") returned 0x0 [0057.433] GetProcessHeap () returned 0x1130000 [0057.433] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.434] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\cVv2z.avi.wctc") returned 47 [0057.434] CloseHandle (hObject=0x3c0) returned 1 [0057.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\cVv2z.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\cvv2z.avi"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\cVv2z.avi.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\cvv2z.avi.wctc")) returned 1 [0057.435] GetProcessHeap () returned 0x1130000 [0057.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.435] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 410 [0057.435] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.435] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a59d790, ftCreationTime.dwHighDateTime=0x1d4cf19, ftLastAccessTime.dwLowDateTime=0x2b4e3050, ftLastAccessTime.dwHighDateTime=0x1d4cfe2, ftLastWriteTime.dwLowDateTime=0x2b4e3050, ftLastWriteTime.dwHighDateTime=0x1d4cfe2, nFileSizeHigh=0x0, nFileSizeLow=0x17b62, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="D6ymtsmn.mkv", cAlternateFileName="")) returned 1 [0057.435] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\D6ymtsmn.mkv") returned 45 [0057.435] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\D6ymtsmn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\d6ymtsmn.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.435] StrStrW (lpFirst="D6ymtsmn.mkv", lpSrch=".wctc") returned 0x0 [0057.435] GetProcessHeap () returned 0x1130000 [0057.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.435] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\D6ymtsmn.mkv.wctc") returned 50 [0057.435] CloseHandle (hObject=0x3c0) returned 1 [0057.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\D6ymtsmn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\d6ymtsmn.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\D6ymtsmn.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\d6ymtsmn.mkv.wctc")) returned 1 [0057.436] GetProcessHeap () returned 0x1130000 [0057.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.436] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 411 [0057.436] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.436] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cdad530, ftCreationTime.dwHighDateTime=0x1d4ced4, ftLastAccessTime.dwLowDateTime=0x374079c0, ftLastAccessTime.dwHighDateTime=0x1d4d0d9, ftLastWriteTime.dwLowDateTime=0x374079c0, ftLastWriteTime.dwHighDateTime=0x1d4d0d9, nFileSizeHigh=0x0, nFileSizeLow=0x18885, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="iZ35zqf3qaBw8lmfJs.avi", cAlternateFileName="IZ35ZQ~1.AVI")) returned 1 [0057.436] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\iZ35zqf3qaBw8lmfJs.avi") returned 55 [0057.436] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\iZ35zqf3qaBw8lmfJs.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\iz35zqf3qabw8lmfjs.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.436] StrStrW (lpFirst="iZ35zqf3qaBw8lmfJs.avi", lpSrch=".wctc") returned 0x0 [0057.436] GetProcessHeap () returned 0x1130000 [0057.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.436] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\iZ35zqf3qaBw8lmfJs.avi.wctc") returned 60 [0057.436] CloseHandle (hObject=0x3c0) returned 1 [0057.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\iZ35zqf3qaBw8lmfJs.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\iz35zqf3qabw8lmfjs.avi"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\iZ35zqf3qaBw8lmfJs.avi.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\iz35zqf3qabw8lmfjs.avi.wctc")) returned 1 [0057.437] GetProcessHeap () returned 0x1130000 [0057.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.437] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 412 [0057.437] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.437] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a7d5690, ftCreationTime.dwHighDateTime=0x1d4c7f1, ftLastAccessTime.dwLowDateTime=0xf36658e0, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0xf36658e0, ftLastWriteTime.dwHighDateTime=0x1d4d165, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="jpvh", cAlternateFileName="")) returned 1 [0057.437] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh") returned 37 [0057.437] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf328b3f5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.437] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\read_me.txt") returned 44 [0057.437] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.437] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.437] GetProcessHeap () returned 0x1130000 [0057.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.437] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\TTSaUM07xHhp.flv.wctc") returned 54 [0057.437] CloseHandle (hObject=0x3c0) returned 1 [0057.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\TTSaUM07xHhp.flv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\ttsaum07xhhp.flv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\TTSaUM07xHhp.flv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\ttsaum07xhhp.flv.wctc")) returned 1 [0057.438] GetProcessHeap () returned 0x1130000 [0057.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.438] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 413 [0057.438] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.438] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62dd3720, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0x968a7cd0, ftLastAccessTime.dwHighDateTime=0x1d4d5cc, ftLastWriteTime.dwLowDateTime=0x968a7cd0, ftLastWriteTime.dwHighDateTime=0x1d4d5cc, nFileSizeHigh=0x0, nFileSizeLow=0x8dbb, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="YdalVXYBHQYYCAU4A.avi", cAlternateFileName="YDALVX~1.AVI")) returned 1 [0057.438] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\YdalVXYBHQYYCAU4A.avi") returned 54 [0057.438] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\YdalVXYBHQYYCAU4A.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\ydalvxybhqyycau4a.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.438] StrStrW (lpFirst="YdalVXYBHQYYCAU4A.avi", lpSrch=".wctc") returned 0x0 [0057.438] GetProcessHeap () returned 0x1130000 [0057.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.438] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\YdalVXYBHQYYCAU4A.avi.wctc") returned 59 [0057.438] CloseHandle (hObject=0x3c0) returned 1 [0057.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\YdalVXYBHQYYCAU4A.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\ydalvxybhqyycau4a.avi"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\YdalVXYBHQYYCAU4A.avi.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\ydalvxybhqyycau4a.avi.wctc")) returned 1 [0057.438] GetProcessHeap () returned 0x1130000 [0057.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.438] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 414 [0057.438] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.438] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62dd3720, ftCreationTime.dwHighDateTime=0x1d4d184, ftLastAccessTime.dwLowDateTime=0x968a7cd0, ftLastAccessTime.dwHighDateTime=0x1d4d5cc, ftLastWriteTime.dwLowDateTime=0x968a7cd0, ftLastWriteTime.dwHighDateTime=0x1d4d5cc, nFileSizeHigh=0x0, nFileSizeLow=0x8dbb, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="ydalvxybhqyycau4a.avi", cAlternateFileName="YDALVX~1.AVI")) returned 0 [0057.438] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.439] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\read_me.txt") returned 44 [0057.439] GetProcessHeap () returned 0x1130000 [0057.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.439] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 159 [0057.439] GetProcessHeap () returned 0x1130000 [0057.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4010060 | out: hHeap=0x1130000) returned 1 [0057.440] GetProcessHeap () returned 0x1130000 [0057.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.441] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\*") returned 39 [0057.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a7d5690, ftCreationTime.dwHighDateTime=0x1d4c7f1, ftLastAccessTime.dwLowDateTime=0xf36658e0, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.441] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\.") returned 39 [0057.441] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a7d5690, ftCreationTime.dwHighDateTime=0x1d4c7f1, ftLastAccessTime.dwLowDateTime=0xf36658e0, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.441] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\..") returned 40 [0057.441] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfacfe850, ftCreationTime.dwHighDateTime=0x1d4ca79, ftLastAccessTime.dwLowDateTime=0x1f38e4a0, ftLastAccessTime.dwHighDateTime=0x1d4d3c4, ftLastWriteTime.dwLowDateTime=0x1f38e4a0, ftLastWriteTime.dwHighDateTime=0x1d4d3c4, nFileSizeHigh=0x0, nFileSizeLow=0x8986, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="4EhZ.swf", cAlternateFileName="")) returned 1 [0057.441] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\4EhZ.swf") returned 46 [0057.441] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\4EhZ.swf" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\4ehz.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.442] StrStrW (lpFirst="4EhZ.swf", lpSrch=".wctc") returned 0x0 [0057.442] GetProcessHeap () returned 0x1130000 [0057.442] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.442] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\4EhZ.swf.wctc") returned 51 [0057.442] CloseHandle (hObject=0x3c0) returned 1 [0057.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\4EhZ.swf" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\4ehz.swf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\4EhZ.swf.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\4ehz.swf.wctc")) returned 1 [0057.443] GetProcessHeap () returned 0x1130000 [0057.443] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.443] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 415 [0057.443] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.443] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33cf39b0, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0x794a68c0, ftLastAccessTime.dwHighDateTime=0x1d4d260, ftLastWriteTime.dwLowDateTime=0x794a68c0, ftLastWriteTime.dwHighDateTime=0x1d4d260, nFileSizeHigh=0x0, nFileSizeLow=0x14e23, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="5peZoAZLUm.avi", cAlternateFileName="5PEZOA~1.AVI")) returned 1 [0057.443] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\5peZoAZLUm.avi") returned 52 [0057.443] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\5peZoAZLUm.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\5pezoazlum.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.443] StrStrW (lpFirst="5peZoAZLUm.avi", lpSrch=".wctc") returned 0x0 [0057.443] GetProcessHeap () returned 0x1130000 [0057.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.443] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\5peZoAZLUm.avi.wctc") returned 57 [0057.443] CloseHandle (hObject=0x3c0) returned 1 [0057.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\5peZoAZLUm.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\5pezoazlum.avi"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\5peZoAZLUm.avi.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\5pezoazlum.avi.wctc")) returned 1 [0057.444] GetProcessHeap () returned 0x1130000 [0057.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.444] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 416 [0057.444] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.444] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a296ef0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0x1e781aa0, ftLastAccessTime.dwHighDateTime=0x1d4c6a8, ftLastWriteTime.dwLowDateTime=0x1e781aa0, ftLastWriteTime.dwHighDateTime=0x1d4c6a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="PZ4ukYICvjeTK9jR", cAlternateFileName="PZ4UKY~1")) returned 1 [0057.444] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR") returned 54 [0057.444] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf328b3f5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.444] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\read_me.txt") returned 49 [0057.444] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.444] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.444] GetProcessHeap () returned 0x1130000 [0057.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.444] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\_baVXGsnm7.flv.wctc") returned 57 [0057.444] CloseHandle (hObject=0x3c0) returned 1 [0057.444] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\_baVXGsnm7.flv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\_bavxgsnm7.flv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\_baVXGsnm7.flv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\_bavxgsnm7.flv.wctc")) returned 1 [0057.445] GetProcessHeap () returned 0x1130000 [0057.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.445] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 417 [0057.445] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.445] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd37b2e80, ftCreationTime.dwHighDateTime=0x1d4c755, ftLastAccessTime.dwLowDateTime=0x86f3f8e0, ftLastAccessTime.dwHighDateTime=0x1d4cce5, ftLastWriteTime.dwLowDateTime=0x86f3f8e0, ftLastWriteTime.dwHighDateTime=0x1d4cce5, nFileSizeHigh=0x0, nFileSizeLow=0x129b1, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="_bavxgsnm7.flv", cAlternateFileName="_BAVXG~1.FLV")) returned 0 [0057.445] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0057.445] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\read_me.txt") returned 49 [0057.445] GetProcessHeap () returned 0x1130000 [0057.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.446] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 160 [0057.446] GetProcessHeap () returned 0x1130000 [0057.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4030070 | out: hHeap=0x1130000) returned 1 [0057.446] GetProcessHeap () returned 0x1130000 [0057.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4030070 [0057.446] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\*") returned 56 [0057.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a296ef0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0x1e781aa0, ftLastAccessTime.dwHighDateTime=0x1d4c6a8, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.446] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\.") returned 56 [0057.446] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a296ef0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0x1e781aa0, ftLastAccessTime.dwHighDateTime=0x1d4c6a8, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.446] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\..") returned 57 [0057.446] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d12c10, ftCreationTime.dwHighDateTime=0x1d4c9c6, ftLastAccessTime.dwLowDateTime=0x9f04fb20, ftLastAccessTime.dwHighDateTime=0x1d4d382, ftLastWriteTime.dwLowDateTime=0x9f04fb20, ftLastWriteTime.dwHighDateTime=0x1d4d382, nFileSizeHigh=0x0, nFileSizeLow=0x17a8e, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="FAR8.mkv", cAlternateFileName="")) returned 1 [0057.446] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\FAR8.mkv") returned 63 [0057.446] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\FAR8.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\far8.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.446] StrStrW (lpFirst="FAR8.mkv", lpSrch=".wctc") returned 0x0 [0057.447] GetProcessHeap () returned 0x1130000 [0057.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.447] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\FAR8.mkv.wctc") returned 68 [0057.447] CloseHandle (hObject=0x3c0) returned 1 [0057.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\FAR8.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\far8.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\FAR8.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\far8.mkv.wctc")) returned 1 [0057.448] GetProcessHeap () returned 0x1130000 [0057.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.448] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 418 [0057.448] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.448] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf923bb20, ftCreationTime.dwHighDateTime=0x1d4cfac, ftLastAccessTime.dwLowDateTime=0x9da64080, ftLastAccessTime.dwHighDateTime=0x1d4cd16, ftLastWriteTime.dwLowDateTime=0x9da64080, ftLastWriteTime.dwHighDateTime=0x1d4cd16, nFileSizeHigh=0x0, nFileSizeLow=0x13308, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="kgc-fFe9y6dJDK8RO.flv", cAlternateFileName="KGC-FF~1.FLV")) returned 1 [0057.448] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\kgc-fFe9y6dJDK8RO.flv") returned 76 [0057.448] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\kgc-fFe9y6dJDK8RO.flv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\kgc-ffe9y6djdk8ro.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.448] StrStrW (lpFirst="kgc-fFe9y6dJDK8RO.flv", lpSrch=".wctc") returned 0x0 [0057.448] GetProcessHeap () returned 0x1130000 [0057.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.448] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\kgc-fFe9y6dJDK8RO.flv.wctc") returned 81 [0057.448] CloseHandle (hObject=0x3c0) returned 1 [0057.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\kgc-fFe9y6dJDK8RO.flv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\kgc-ffe9y6djdk8ro.flv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\kgc-fFe9y6dJDK8RO.flv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\kgc-ffe9y6djdk8ro.flv.wctc")) returned 1 [0057.449] GetProcessHeap () returned 0x1130000 [0057.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.449] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 419 [0057.449] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.449] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47563c0, ftCreationTime.dwHighDateTime=0x1d4c60d, ftLastAccessTime.dwLowDateTime=0x14eb4d40, ftLastAccessTime.dwHighDateTime=0x1d4c716, ftLastWriteTime.dwLowDateTime=0x14eb4d40, ftLastWriteTime.dwHighDateTime=0x1d4c716, nFileSizeHigh=0x0, nFileSizeLow=0x147d5, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="QBUI.mkv", cAlternateFileName="")) returned 1 [0057.449] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\QBUI.mkv") returned 63 [0057.449] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\QBUI.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\qbui.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.449] StrStrW (lpFirst="QBUI.mkv", lpSrch=".wctc") returned 0x0 [0057.449] GetProcessHeap () returned 0x1130000 [0057.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.449] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\QBUI.mkv.wctc") returned 68 [0057.449] CloseHandle (hObject=0x3c0) returned 1 [0057.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\QBUI.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\qbui.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\QBUI.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\qbui.mkv.wctc")) returned 1 [0057.450] GetProcessHeap () returned 0x1130000 [0057.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.450] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 420 [0057.459] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.459] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf328b3f5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.459] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\read_me.txt") returned 66 [0057.459] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.460] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.460] GetProcessHeap () returned 0x1130000 [0057.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0057.460] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\W8JozW4L-K2p0JZS.flv.wctc") returned 80 [0057.460] CloseHandle (hObject=0x3c0) returned 1 [0057.460] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\W8JozW4L-K2p0JZS.flv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\w8jozw4l-k2p0jzs.flv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\W8JozW4L-K2p0JZS.flv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\w8jozw4l-k2p0jzs.flv.wctc")) returned 1 [0057.460] GetProcessHeap () returned 0x1130000 [0057.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.460] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 424 [0057.460] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.460] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e70580, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xb93b2330, ftLastAccessTime.dwHighDateTime=0x1d4d480, ftLastWriteTime.dwLowDateTime=0xb93b2330, ftLastWriteTime.dwHighDateTime=0x1d4d480, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="xHSTZp32BgqiA7f", cAlternateFileName="XHSTZP~1")) returned 1 [0057.460] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f") returned 70 [0057.460] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2662fd0, ftCreationTime.dwHighDateTime=0x1d4cda8, ftLastAccessTime.dwLowDateTime=0xc658cef0, ftLastAccessTime.dwHighDateTime=0x1d4c81e, ftLastWriteTime.dwLowDateTime=0xc658cef0, ftLastWriteTime.dwHighDateTime=0x1d4c81e, nFileSizeHigh=0x0, nFileSizeLow=0x151ba, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="yBMd5uXzGdZpKiWFi.swf", cAlternateFileName="YBMD5U~1.SWF")) returned 1 [0057.460] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yBMd5uXzGdZpKiWFi.swf") returned 76 [0057.461] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yBMd5uXzGdZpKiWFi.swf" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\ybmd5uxzgdzpkiwfi.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.461] StrStrW (lpFirst="yBMd5uXzGdZpKiWFi.swf", lpSrch=".wctc") returned 0x0 [0057.461] GetProcessHeap () returned 0x1130000 [0057.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0057.461] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yBMd5uXzGdZpKiWFi.swf.wctc") returned 81 [0057.461] CloseHandle (hObject=0x3c0) returned 1 [0057.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yBMd5uXzGdZpKiWFi.swf" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\ybmd5uxzgdzpkiwfi.swf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yBMd5uXzGdZpKiWFi.swf.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\ybmd5uxzgdzpkiwfi.swf.wctc")) returned 1 [0057.461] GetProcessHeap () returned 0x1130000 [0057.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.461] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 425 [0057.461] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.461] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe60bdd20, ftCreationTime.dwHighDateTime=0x1d4d190, ftLastAccessTime.dwLowDateTime=0xc607ea0, ftLastAccessTime.dwHighDateTime=0x1d4cbfa, ftLastWriteTime.dwLowDateTime=0xc607ea0, ftLastWriteTime.dwHighDateTime=0x1d4cbfa, nFileSizeHigh=0x0, nFileSizeLow=0x13503, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="yxoVrOwSdhW1O.flv", cAlternateFileName="YXOVRO~1.FLV")) returned 1 [0057.461] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yxoVrOwSdhW1O.flv") returned 72 [0057.461] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yxoVrOwSdhW1O.flv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\yxovrowsdhw1o.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.461] StrStrW (lpFirst="yxoVrOwSdhW1O.flv", lpSrch=".wctc") returned 0x0 [0057.462] GetProcessHeap () returned 0x1130000 [0057.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0057.462] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yxoVrOwSdhW1O.flv.wctc") returned 77 [0057.462] CloseHandle (hObject=0x3c0) returned 1 [0057.462] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yxoVrOwSdhW1O.flv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\yxovrowsdhw1o.flv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\yxoVrOwSdhW1O.flv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\yxovrowsdhw1o.flv.wctc")) returned 1 [0057.462] GetProcessHeap () returned 0x1130000 [0057.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.462] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 426 [0057.462] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.462] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe60bdd20, ftCreationTime.dwHighDateTime=0x1d4d190, ftLastAccessTime.dwLowDateTime=0xc607ea0, ftLastAccessTime.dwHighDateTime=0x1d4cbfa, ftLastWriteTime.dwLowDateTime=0xc607ea0, ftLastWriteTime.dwHighDateTime=0x1d4cbfa, nFileSizeHigh=0x0, nFileSizeLow=0x13503, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="yxovrowsdhw1o.flv", cAlternateFileName="YXOVRO~1.FLV")) returned 0 [0057.462] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.462] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\read_me.txt") returned 66 [0057.462] GetProcessHeap () returned 0x1130000 [0057.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4030070 | out: hHeap=0x1130000) returned 1 [0057.463] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 162 [0057.463] GetProcessHeap () returned 0x1130000 [0057.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4050080 | out: hHeap=0x1130000) returned 1 [0057.463] GetProcessHeap () returned 0x1130000 [0057.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4050080 [0057.463] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\*") returned 41 [0057.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7398ab0, ftCreationTime.dwHighDateTime=0x1d4cc66, ftLastAccessTime.dwLowDateTime=0xa22575c0, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.463] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\.") returned 41 [0057.463] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7398ab0, ftCreationTime.dwHighDateTime=0x1d4cc66, ftLastAccessTime.dwLowDateTime=0xa22575c0, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.463] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\..") returned 42 [0057.463] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf952680, ftCreationTime.dwHighDateTime=0x1d4d10d, ftLastAccessTime.dwLowDateTime=0x3205220, ftLastAccessTime.dwHighDateTime=0x1d4c86c, ftLastWriteTime.dwLowDateTime=0x3205220, ftLastWriteTime.dwHighDateTime=0x1d4c86c, nFileSizeHigh=0x0, nFileSizeLow=0x18831, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="11FSDCkn8jsFJSMV0g.mkv", cAlternateFileName="11FSDC~1.MKV")) returned 1 [0057.463] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\11FSDCkn8jsFJSMV0g.mkv") returned 62 [0057.464] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\11FSDCkn8jsFJSMV0g.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\11fsdckn8jsfjsmv0g.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.464] StrStrW (lpFirst="11FSDCkn8jsFJSMV0g.mkv", lpSrch=".wctc") returned 0x0 [0057.464] GetProcessHeap () returned 0x1130000 [0057.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4030070 [0057.465] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\11FSDCkn8jsFJSMV0g.mkv.wctc") returned 67 [0057.465] CloseHandle (hObject=0x3c0) returned 1 [0057.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\11FSDCkn8jsFJSMV0g.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\11fsdckn8jsfjsmv0g.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\11FSDCkn8jsFJSMV0g.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\11fsdckn8jsfjsmv0g.mkv.wctc")) returned 1 [0057.465] GetProcessHeap () returned 0x1130000 [0057.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4030070 | out: hHeap=0x1130000) returned 1 [0057.465] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 427 [0057.465] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.465] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f4fc6a0, ftCreationTime.dwHighDateTime=0x1d4d3ac, ftLastAccessTime.dwLowDateTime=0xd23b6c00, ftLastAccessTime.dwHighDateTime=0x1d4cf2b, ftLastWriteTime.dwLowDateTime=0xd23b6c00, ftLastWriteTime.dwHighDateTime=0x1d4cf2b, nFileSizeHigh=0x0, nFileSizeLow=0x47f9, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="a1y4oa7JEiJ6.mkv", cAlternateFileName="A1Y4OA~1.MKV")) returned 1 [0057.465] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\a1y4oa7JEiJ6.mkv") returned 56 [0057.465] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\a1y4oa7JEiJ6.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\a1y4oa7jeij6.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.465] StrStrW (lpFirst="a1y4oa7JEiJ6.mkv", lpSrch=".wctc") returned 0x0 [0057.465] GetProcessHeap () returned 0x1130000 [0057.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4030070 [0057.465] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\a1y4oa7JEiJ6.mkv.wctc") returned 61 [0057.465] CloseHandle (hObject=0x3c0) returned 1 [0057.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\a1y4oa7JEiJ6.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\a1y4oa7jeij6.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\a1y4oa7JEiJ6.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\a1y4oa7jeij6.mkv.wctc")) returned 1 [0057.466] GetProcessHeap () returned 0x1130000 [0057.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4030070 | out: hHeap=0x1130000) returned 1 [0057.466] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 428 [0057.466] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.466] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95eb70c0, ftCreationTime.dwHighDateTime=0x1d4c962, ftLastAccessTime.dwLowDateTime=0x8fa10220, ftLastAccessTime.dwHighDateTime=0x1d4c999, ftLastWriteTime.dwLowDateTime=0x8fa10220, ftLastWriteTime.dwHighDateTime=0x1d4c999, nFileSizeHigh=0x0, nFileSizeLow=0x8a23, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="lG-0dVVk.mkv", cAlternateFileName="")) returned 1 [0057.466] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\lG-0dVVk.mkv") returned 52 [0057.467] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\lG-0dVVk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\lg-0dvvk.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.467] StrStrW (lpFirst="lG-0dVVk.mkv", lpSrch=".wctc") returned 0x0 [0057.467] GetProcessHeap () returned 0x1130000 [0057.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4030070 [0057.467] wnsprintfW (in: pszDest=0x4030070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\lG-0dVVk.mkv.wctc") returned 57 [0057.467] CloseHandle (hObject=0x3c0) returned 1 [0057.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\lG-0dVVk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\lg-0dvvk.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\lG-0dVVk.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\lg-0dvvk.mkv.wctc")) returned 1 [0057.467] GetProcessHeap () returned 0x1130000 [0057.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4030070 | out: hHeap=0x1130000) returned 1 [0057.467] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 429 [0057.467] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.467] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf328b3f5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.467] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\read_me.txt") returned 51 [0057.467] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\Y00L86e893nr\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\videos\\y00l86e893nr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.468] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.468] GetProcessHeap () returned 0x1130000 [0057.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4050080 | out: hHeap=0x1130000) returned 1 [0057.468] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 163 [0057.468] GetProcessHeap () returned 0x1130000 [0057.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4020068 | out: hHeap=0x1130000) returned 1 [0057.470] GetProcessHeap () returned 0x1130000 [0057.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4050080 [0057.471] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\*") returned 48 [0057.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825881f0, ftCreationTime.dwHighDateTime=0x1d4c7ba, ftLastAccessTime.dwLowDateTime=0x835da5c0, ftLastAccessTime.dwHighDateTime=0x1d4cfe5, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.471] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\.") returned 48 [0057.471] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825881f0, ftCreationTime.dwHighDateTime=0x1d4c7ba, ftLastAccessTime.dwLowDateTime=0x835da5c0, ftLastAccessTime.dwHighDateTime=0x1d4cfe5, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.471] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\..") returned 49 [0057.471] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abd5f80, ftCreationTime.dwHighDateTime=0x1d4cf61, ftLastAccessTime.dwLowDateTime=0x28453fc0, ftLastAccessTime.dwHighDateTime=0x1d4d0d7, ftLastWriteTime.dwLowDateTime=0x28453fc0, ftLastWriteTime.dwHighDateTime=0x1d4d0d7, nFileSizeHigh=0x0, nFileSizeLow=0x140ed, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="GYcr.avi", cAlternateFileName="")) returned 1 [0057.471] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\GYcr.avi") returned 55 [0057.471] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\GYcr.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\gycr.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.471] StrStrW (lpFirst="GYcr.avi", lpSrch=".wctc") returned 0x0 [0057.471] GetProcessHeap () returned 0x1130000 [0057.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0057.472] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\GYcr.avi.wctc") returned 60 [0057.472] CloseHandle (hObject=0x3c0) returned 1 [0057.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\GYcr.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\gycr.avi"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\GYcr.avi.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\gycr.avi.wctc")) returned 1 [0057.473] GetProcessHeap () returned 0x1130000 [0057.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.473] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 430 [0057.473] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.473] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde53400, ftCreationTime.dwHighDateTime=0x1d4cfa9, ftLastAccessTime.dwLowDateTime=0x41060a00, ftLastAccessTime.dwHighDateTime=0x1d4c8ce, ftLastWriteTime.dwLowDateTime=0x41060a00, ftLastWriteTime.dwHighDateTime=0x1d4c8ce, nFileSizeHigh=0x0, nFileSizeLow=0x6eeb, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="QmOhthVz8gr.swf", cAlternateFileName="QMOHTH~1.SWF")) returned 1 [0057.473] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\QmOhthVz8gr.swf") returned 62 [0057.473] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\QmOhthVz8gr.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\qmohthvz8gr.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.473] StrStrW (lpFirst="QmOhthVz8gr.swf", lpSrch=".wctc") returned 0x0 [0057.473] GetProcessHeap () returned 0x1130000 [0057.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0057.473] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\QmOhthVz8gr.swf.wctc") returned 67 [0057.473] CloseHandle (hObject=0x3c0) returned 1 [0057.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\QmOhthVz8gr.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\qmohthvz8gr.swf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\QmOhthVz8gr.swf.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\qmohthvz8gr.swf.wctc")) returned 1 [0057.473] GetProcessHeap () returned 0x1130000 [0057.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.473] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 431 [0057.473] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.474] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf328b3f5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.474] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\read_me.txt") returned 58 [0057.474] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.474] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.474] GetProcessHeap () returned 0x1130000 [0057.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0057.474] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\sqCKgzove4ZTlU.mkv.wctc") returned 70 [0057.474] CloseHandle (hObject=0x3c0) returned 1 [0057.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\sqCKgzove4ZTlU.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\sqckgzove4ztlu.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\sqCKgzove4ZTlU.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\ycteyz3k e_kh_nyjci\\sqckgzove4ztlu.mkv.wctc")) returned 1 [0057.474] GetProcessHeap () returned 0x1130000 [0057.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.474] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 432 [0057.474] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.474] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1f270, ftCreationTime.dwHighDateTime=0x1d4cc7b, ftLastAccessTime.dwLowDateTime=0xd5be1af0, ftLastAccessTime.dwHighDateTime=0x1d4d48d, ftLastWriteTime.dwLowDateTime=0xd5be1af0, ftLastWriteTime.dwHighDateTime=0x1d4d48d, nFileSizeHigh=0x0, nFileSizeLow=0x13862, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="sqckgzove4ztlu.mkv", cAlternateFileName="SQCKGZ~1.MKV")) returned 0 [0057.475] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.475] wnsprintfW (in: pszDest=0x4050080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\YcteYZ3k e_kH_NYjCi\\read_me.txt") returned 58 [0057.475] GetProcessHeap () returned 0x1130000 [0057.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4050080 | out: hHeap=0x1130000) returned 1 [0057.475] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 164 [0057.475] GetProcessHeap () returned 0x1130000 [0057.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4040078 | out: hHeap=0x1130000) returned 1 [0057.478] GetProcessHeap () returned 0x1130000 [0057.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0057.479] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\*") returned 21 [0057.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf33e294a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.479] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\.") returned 21 [0057.479] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf33e294a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.479] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\..") returned 22 [0057.479] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0057.479] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\AccountPictures") returned 35 [0057.479] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="Desktop", cAlternateFileName="")) returned 1 [0057.479] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop") returned 27 [0057.479] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.479] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\desktop.ini") returned 31 [0057.479] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.479] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.479] GetProcessHeap () returned 0x1130000 [0057.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.479] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 165 [0057.479] GetProcessHeap () returned 0x1130000 [0057.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d100e0 | out: hHeap=0x1130000) returned 1 [0057.486] GetProcessHeap () returned 0x1130000 [0057.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4070090 [0057.487] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\AccountPictures\\*") returned 37 [0057.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.487] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\AccountPictures\\.") returned 37 [0057.487] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.487] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\AccountPictures\\..") returned 38 [0057.487] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.487] wnsprintfW (in: pszDest=0x4070090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\AccountPictures\\desktop.ini") returned 47 [0057.487] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.487] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.487] GetProcessHeap () returned 0x1130000 [0057.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.488] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 166 [0057.488] GetProcessHeap () returned 0x1130000 [0057.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4060088 | out: hHeap=0x1130000) returned 1 [0057.488] GetProcessHeap () returned 0x1130000 [0057.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.489] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\*") returned 29 [0057.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.489] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\.") returned 29 [0057.489] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.489] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\..") returned 30 [0057.489] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0057.489] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned 49 [0057.489] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.490] StrStrW (lpFirst="Acrobat Reader DC.lnk", lpSrch=".wctc") returned 0x0 [0057.490] GetProcessHeap () returned 0x1130000 [0057.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.491] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.wctc") returned 54 [0057.491] CloseHandle (hObject=0x3c0) returned 1 [0057.491] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.wctc" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.wctc")) returned 1 [0057.510] GetProcessHeap () returned 0x1130000 [0057.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.513] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 433 [0057.513] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.513] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.513] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\desktop.ini") returned 39 [0057.513] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.513] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.513] GetProcessHeap () returned 0x1130000 [0057.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.514] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\Google Chrome.lnk.wctc") returned 50 [0057.514] CloseHandle (hObject=0x3c0) returned 1 [0057.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Google Chrome.lnk.wctc" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.wctc")) returned 1 [0057.515] GetProcessHeap () returned 0x1130000 [0057.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.515] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 434 [0057.515] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.515] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0057.515] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned 47 [0057.515] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.515] StrStrW (lpFirst="Mozilla Firefox.lnk", lpSrch=".wctc") returned 0x0 [0057.515] GetProcessHeap () returned 0x1130000 [0057.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.515] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.wctc") returned 52 [0057.515] CloseHandle (hObject=0x3c0) returned 1 [0057.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.wctc" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.wctc")) returned 1 [0057.518] GetProcessHeap () returned 0x1130000 [0057.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.518] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 435 [0057.518] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.518] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32b1300, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.518] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\read_me.txt") returned 39 [0057.518] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\read_me.txt" (normalized: "c:\\users\\public\\desktop\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.519] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.519] GetProcessHeap () returned 0x1130000 [0057.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.519] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 168 [0057.519] GetProcessHeap () returned 0x1130000 [0057.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3670090 | out: hHeap=0x1130000) returned 1 [0057.520] GetProcessHeap () returned 0x1130000 [0057.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.521] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\*") returned 40 [0057.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32b1300, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0057.521] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\read_me.txt") returned 50 [0057.521] GetProcessHeap () returned 0x1130000 [0057.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.521] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 169 [0057.521] GetProcessHeap () returned 0x1130000 [0057.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40900a0 | out: hHeap=0x1130000) returned 1 [0057.522] GetProcessHeap () returned 0x1130000 [0057.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x40900a0 [0057.522] wnsprintfW (in: pszDest=0x40900a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\*") returned 43 [0057.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32b1300, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0057.523] wnsprintfW (in: pszDest=0x40900a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\read_me.txt") returned 53 [0057.523] GetProcessHeap () returned 0x1130000 [0057.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40900a0 | out: hHeap=0x1130000) returned 1 [0057.523] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 170 [0057.523] GetProcessHeap () returned 0x1130000 [0057.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40a00a8 | out: hHeap=0x1130000) returned 1 [0057.524] GetProcessHeap () returned 0x1130000 [0057.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.525] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\*") returned 41 [0057.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32b1300, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0057.525] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\read_me.txt") returned 51 [0057.525] GetProcessHeap () returned 0x1130000 [0057.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.525] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 171 [0057.525] GetProcessHeap () returned 0x1130000 [0057.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40b00b0 | out: hHeap=0x1130000) returned 1 [0057.526] GetProcessHeap () returned 0x1130000 [0057.526] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.527] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Downloads\\*") returned 31 [0057.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf32d77f6, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.527] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Downloads\\.") returned 31 [0057.527] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf32d77f6, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.527] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Downloads\\..") returned 32 [0057.527] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.527] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Downloads\\desktop.ini") returned 41 [0057.527] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.528] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.528] GetProcessHeap () returned 0x1130000 [0057.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.528] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 172 [0057.528] GetProcessHeap () returned 0x1130000 [0057.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4080098 | out: hHeap=0x1130000) returned 1 [0057.530] GetProcessHeap () returned 0x1130000 [0057.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.531] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Libraries\\*") returned 31 [0057.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf32d77f6, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.531] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Libraries\\.") returned 31 [0057.531] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf32d77f6, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.531] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Libraries\\..") returned 32 [0057.531] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.531] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Libraries\\desktop.ini") returned 41 [0057.531] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.531] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.532] GetProcessHeap () returned 0x1130000 [0057.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70008 [0057.532] wnsprintfW (in: pszDest=0x3f70008, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.wctc") returned 56 [0057.532] CloseHandle (hObject=0x3c0) returned 1 [0057.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.wctc" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.wctc")) returned 1 [0057.533] GetProcessHeap () returned 0x1130000 [0057.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70008 | out: hHeap=0x1130000) returned 1 [0057.533] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 436 [0057.533] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.533] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="recordedtv.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0057.533] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.534] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Libraries\\read_me.txt") returned 41 [0057.534] GetProcessHeap () returned 0x1130000 [0057.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.534] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 173 [0057.534] GetProcessHeap () returned 0x1130000 [0057.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40c00b8 | out: hHeap=0x1130000) returned 1 [0057.536] GetProcessHeap () returned 0x1130000 [0057.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.537] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Music\\*") returned 27 [0057.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Music\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.537] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Music\\.") returned 27 [0057.537] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.537] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Music\\..") returned 28 [0057.537] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.537] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Music\\desktop.ini") returned 37 [0057.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.537] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.537] GetProcessHeap () returned 0x1130000 [0057.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.538] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 174 [0057.538] GetProcessHeap () returned 0x1130000 [0057.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40d00c0 | out: hHeap=0x1130000) returned 1 [0057.540] GetProcessHeap () returned 0x1130000 [0057.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.541] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Pictures\\*") returned 30 [0057.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.541] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Pictures\\.") returned 30 [0057.541] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.541] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Pictures\\..") returned 31 [0057.541] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.541] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Pictures\\desktop.ini") returned 40 [0057.541] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.541] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.542] GetProcessHeap () returned 0x1130000 [0057.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.542] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 175 [0057.542] GetProcessHeap () returned 0x1130000 [0057.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40e00c8 | out: hHeap=0x1130000) returned 1 [0057.542] GetProcessHeap () returned 0x1130000 [0057.542] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.543] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Videos\\*") returned 28 [0057.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\*", lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.543] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Videos\\.") returned 28 [0057.543] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf32b1300, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.543] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Videos\\..") returned 29 [0057.543] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x30ef598 | out: lpFindFileData=0x30ef598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.543] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Videos\\desktop.ini") returned 38 [0057.543] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.544] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.693] GetProcessHeap () returned 0x1130000 [0057.693] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.694] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 176 [0057.694] GetProcessHeap () returned 0x1130000 [0057.694] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x40f00d0 | out: hHeap=0x1130000) returned 1 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0057.695] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.695] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x11756f8 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.695] GetProcessHeap () returned 0x1130000 [0057.695] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.695] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.696] GetProcessHeap () returned 0x1130000 [0057.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.697] GetProcessHeap () returned 0x1130000 [0057.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.698] GetProcessHeap () returned 0x1130000 [0057.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0057.699] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.699] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.699] CloseHandle (hObject=0x3a8) returned 0 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.699] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 134 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0057.699] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0057.699] GetProcessHeap () returned 0x1130000 [0057.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.699] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.700] GetProcessHeap () returned 0x1130000 [0057.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.700] GetProcessHeap () returned 0x1130000 [0057.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0057.700] GetProcessHeap () returned 0x1130000 [0057.700] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x11758d8 [0057.700] GetProcessHeap () returned 0x1130000 [0057.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0057.700] GetProcessHeap () returned 0x1130000 [0057.700] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175928 [0057.700] GetProcessHeap () returned 0x1130000 [0057.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.700] GetProcessHeap () returned 0x1130000 [0057.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.700] GetProcessHeap () returned 0x1130000 [0057.700] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.700] GetProcessHeap () returned 0x1130000 [0057.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.707] GetProcessHeap () returned 0x1130000 [0057.707] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.708] GetProcessHeap () returned 0x1130000 [0057.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.708] GetProcessHeap () returned 0x1130000 [0057.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.714] GetProcessHeap () returned 0x1130000 [0057.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.714] GetProcessHeap () returned 0x1130000 [0057.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.719] GetProcessHeap () returned 0x1130000 [0057.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.729] GetProcessHeap () returned 0x1130000 [0057.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.729] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de60 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de60 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.730] GetProcessHeap () returned 0x1130000 [0057.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.731] GetProcessHeap () returned 0x1130000 [0057.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.732] GetProcessHeap () returned 0x1130000 [0057.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0057.733] GetProcessHeap () returned 0x1130000 [0057.734] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0057.734] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.734] WriteFile (in: hFile=0x3a8, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.734] CloseHandle (hObject=0x3a8) returned 0 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.734] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 135 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0057.734] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.734] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175860 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.734] GetProcessHeap () returned 0x1130000 [0057.734] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.734] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.735] GetProcessHeap () returned 0x1130000 [0057.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.735] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.736] GetProcessHeap () returned 0x1130000 [0057.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.737] GetProcessHeap () returned 0x1130000 [0057.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.738] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.738] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.738] CloseHandle (hObject=0x3a8) returned 0 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.738] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 136 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0057.738] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0057.738] GetProcessHeap () returned 0x1130000 [0057.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.738] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11758d8 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175b08 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.739] GetProcessHeap () returned 0x1130000 [0057.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.739] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e010 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e010 | out: hHeap=0x1130000) returned 1 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0057.740] GetProcessHeap () returned 0x1130000 [0057.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.741] GetProcessHeap () returned 0x1130000 [0057.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.742] GetProcessHeap () returned 0x1130000 [0057.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0057.742] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.742] WriteFile (in: hFile=0x3a8, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.742] CloseHandle (hObject=0x3a8) returned 0 [0057.742] GetProcessHeap () returned 0x1130000 [0057.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.743] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 137 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0057.743] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.743] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11758b0 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175720 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.743] GetProcessHeap () returned 0x1130000 [0057.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.743] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.744] GetProcessHeap () returned 0x1130000 [0057.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177ad8 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177ad8 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.745] GetProcessHeap () returned 0x1130000 [0057.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.745] GetProcessHeap () returned 0x1130000 [0057.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.746] GetProcessHeap () returned 0x1130000 [0057.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.747] GetProcessHeap () returned 0x1130000 [0057.747] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.747] GetProcessHeap () returned 0x1130000 [0057.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.747] GetProcessHeap () returned 0x1130000 [0057.747] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.747] GetProcessHeap () returned 0x1130000 [0057.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.747] GetProcessHeap () returned 0x1130000 [0057.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.747] GetProcessHeap () returned 0x1130000 [0057.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0057.747] GetProcessHeap () returned 0x1130000 [0057.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.747] GetProcessHeap () returned 0x1130000 [0057.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0057.747] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.747] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.747] CloseHandle (hObject=0x3a8) returned 0 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.748] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 138 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0057.748] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.748] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175860 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.748] GetProcessHeap () returned 0x1130000 [0057.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.748] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.749] GetProcessHeap () returned 0x1130000 [0057.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.749] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.750] GetProcessHeap () returned 0x1130000 [0057.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.751] GetProcessHeap () returned 0x1130000 [0057.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.752] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.752] WriteFile (in: hFile=0x3a8, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.752] CloseHandle (hObject=0x3a8) returned 0 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.752] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 139 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0057.752] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0057.752] ReadFile (in: hFile=0x3a8, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175928 [0057.752] GetProcessHeap () returned 0x1130000 [0057.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175888 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.753] GetProcessHeap () returned 0x1130000 [0057.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.753] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.754] GetProcessHeap () returned 0x1130000 [0057.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.755] GetProcessHeap () returned 0x1130000 [0057.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0057.756] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.756] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.756] CloseHandle (hObject=0x3a8) returned 0 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.756] GetProcessHeap () returned 0x1130000 [0057.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.757] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 140 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0057.757] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.757] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11759c8 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.757] GetProcessHeap () returned 0x1130000 [0057.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.757] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177aa8 [0057.758] GetProcessHeap () returned 0x1130000 [0057.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.758] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177aa8 | out: hHeap=0x1130000) returned 1 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.759] GetProcessHeap () returned 0x1130000 [0057.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.759] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.760] GetProcessHeap () returned 0x1130000 [0057.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.760] GetProcessHeap () returned 0x1130000 [0057.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0057.761] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.761] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.761] CloseHandle (hObject=0x3a8) returned 0 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0057.761] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 141 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0057.761] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.761] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175798 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.761] GetProcessHeap () returned 0x1130000 [0057.761] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.761] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.762] GetProcessHeap () returned 0x1130000 [0057.762] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.771] GetProcessHeap () returned 0x1130000 [0057.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.771] GetProcessHeap () returned 0x1130000 [0057.771] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.771] GetProcessHeap () returned 0x1130000 [0057.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.771] GetProcessHeap () returned 0x1130000 [0057.771] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.771] GetProcessHeap () returned 0x1130000 [0057.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.771] GetProcessHeap () returned 0x1130000 [0057.771] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.771] GetProcessHeap () returned 0x1130000 [0057.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.771] GetProcessHeap () returned 0x1130000 [0057.771] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.771] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.772] GetProcessHeap () returned 0x1130000 [0057.772] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.773] GetProcessHeap () returned 0x1130000 [0057.773] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0057.774] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.774] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.774] CloseHandle (hObject=0x3a8) returned 0 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.774] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 143 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0057.774] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.774] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175798 [0057.774] GetProcessHeap () returned 0x1130000 [0057.774] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x11759a0 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.775] GetProcessHeap () returned 0x1130000 [0057.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177ad8 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177ad8 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.776] GetProcessHeap () returned 0x1130000 [0057.776] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.776] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.777] GetProcessHeap () returned 0x1130000 [0057.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.777] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.778] GetProcessHeap () returned 0x1130000 [0057.778] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0057.778] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.778] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.779] CloseHandle (hObject=0x3a8) returned 0 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.779] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 144 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0057.779] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.779] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175770 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175798 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.779] GetProcessHeap () returned 0x1130000 [0057.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.779] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.780] GetProcessHeap () returned 0x1130000 [0057.780] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.780] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177988 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177988 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.781] GetProcessHeap () returned 0x1130000 [0057.781] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.781] GetProcessHeap () returned 0x1130000 [0057.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.782] GetProcessHeap () returned 0x1130000 [0057.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0057.783] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.783] WriteFile (in: hFile=0x3a8, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.783] CloseHandle (hObject=0x3a8) returned 0 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.783] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 145 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0057.783] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.783] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.783] GetProcessHeap () returned 0x1130000 [0057.783] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175b58 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175860 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.784] GetProcessHeap () returned 0x1130000 [0057.784] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.784] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a48 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a48 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0057.785] GetProcessHeap () returned 0x1130000 [0057.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.785] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.786] GetProcessHeap () returned 0x1130000 [0057.786] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0057.787] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.787] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.787] CloseHandle (hObject=0x3c0) returned 0 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.787] GetProcessHeap () returned 0x1130000 [0057.787] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.788] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 146 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0057.788] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.788] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175ae0 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x11758b0 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.788] GetProcessHeap () returned 0x1130000 [0057.788] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.789] GetProcessHeap () returned 0x1130000 [0057.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.789] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.790] GetProcessHeap () returned 0x1130000 [0057.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.791] GetProcessHeap () returned 0x1130000 [0057.791] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.791] GetProcessHeap () returned 0x1130000 [0057.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0057.792] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.792] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.792] CloseHandle (hObject=0x3c0) returned 0 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.792] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 147 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0057.792] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.792] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175b30 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.792] GetProcessHeap () returned 0x1130000 [0057.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.793] GetProcessHeap () returned 0x1130000 [0057.793] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.793] GetProcessHeap () returned 0x1130000 [0057.794] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.794] GetProcessHeap () returned 0x1130000 [0057.794] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x121ece0 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.795] GetProcessHeap () returned 0x1130000 [0057.795] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.795] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.796] GetProcessHeap () returned 0x1130000 [0057.796] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0057.796] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.796] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.796] CloseHandle (hObject=0x3c0) returned 0 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.797] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 148 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0057.797] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.797] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11759c8 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175860 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.797] GetProcessHeap () returned 0x1130000 [0057.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.797] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.798] GetProcessHeap () returned 0x1130000 [0057.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177898 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177898 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.799] GetProcessHeap () returned 0x1130000 [0057.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.799] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.800] GetProcessHeap () returned 0x1130000 [0057.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0057.801] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.801] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.801] CloseHandle (hObject=0x3c0) returned 0 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0057.801] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 149 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0057.801] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.801] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.801] GetProcessHeap () returned 0x1130000 [0057.801] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a40 [0057.801] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175a68 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.802] GetProcessHeap () returned 0x1130000 [0057.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.802] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e328 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e328 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0057.803] GetProcessHeap () returned 0x1130000 [0057.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.803] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.804] GetProcessHeap () returned 0x1130000 [0057.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0057.805] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.805] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.805] CloseHandle (hObject=0x3c0) returned 0 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0057.805] GetProcessHeap () returned 0x1130000 [0057.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.805] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 150 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0057.806] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.806] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x11756f8 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175a40 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.806] GetProcessHeap () returned 0x1130000 [0057.806] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.806] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.807] GetProcessHeap () returned 0x1130000 [0057.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.808] GetProcessHeap () returned 0x1130000 [0057.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.809] GetProcessHeap () returned 0x1130000 [0057.809] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.832] GetProcessHeap () returned 0x1130000 [0057.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.833] GetProcessHeap () returned 0x1130000 [0057.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.833] GetProcessHeap () returned 0x1130000 [0057.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0057.833] GetProcessHeap () returned 0x1130000 [0057.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.833] GetProcessHeap () returned 0x1130000 [0057.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0057.833] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.834] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.834] CloseHandle (hObject=0x3c0) returned 0 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.834] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 152 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0057.834] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.834] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175a18 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175748 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.834] GetProcessHeap () returned 0x1130000 [0057.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.834] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.835] GetProcessHeap () returned 0x1130000 [0057.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.835] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x121ece0 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.836] GetProcessHeap () returned 0x1130000 [0057.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.836] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.837] GetProcessHeap () returned 0x1130000 [0057.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0057.838] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.838] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.838] CloseHandle (hObject=0x3c0) returned 0 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0057.838] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 153 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0057.838] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.838] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.838] GetProcessHeap () returned 0x1130000 [0057.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.838] GetProcessHeap () returned 0x1130000 [0057.839] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175860 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x11759c8 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.839] GetProcessHeap () returned 0x1130000 [0057.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.840] GetProcessHeap () returned 0x1130000 [0057.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.841] GetProcessHeap () returned 0x1130000 [0057.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.841] GetProcessHeap () returned 0x1130000 [0057.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.841] GetProcessHeap () returned 0x1130000 [0057.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.842] GetProcessHeap () returned 0x1130000 [0057.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.842] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.843] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.843] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.843] CloseHandle (hObject=0x3c0) returned 0 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0057.843] GetProcessHeap () returned 0x1130000 [0057.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0057.843] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 154 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0057.844] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0057.844] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x11759a0 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x11759c8 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.844] GetProcessHeap () returned 0x1130000 [0057.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.844] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177ad8 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.845] GetProcessHeap () returned 0x1130000 [0057.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.845] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177ad8 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.846] GetProcessHeap () returned 0x1130000 [0057.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.847] GetProcessHeap () returned 0x1130000 [0057.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0057.848] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.848] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.848] CloseHandle (hObject=0x3c0) returned 0 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.848] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 155 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0057.848] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.848] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175a18 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175860 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.848] GetProcessHeap () returned 0x1130000 [0057.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.849] GetProcessHeap () returned 0x1130000 [0057.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.849] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.850] GetProcessHeap () returned 0x1130000 [0057.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.850] GetProcessHeap () returned 0x1130000 [0057.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.851] GetProcessHeap () returned 0x1130000 [0057.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0057.852] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.852] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.852] CloseHandle (hObject=0x3c0) returned 0 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.852] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 156 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0057.852] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0057.852] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.852] GetProcessHeap () returned 0x1130000 [0057.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x11759c8 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.853] GetProcessHeap () returned 0x1130000 [0057.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.853] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.854] GetProcessHeap () returned 0x1130000 [0057.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.855] GetProcessHeap () returned 0x1130000 [0057.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.856] GetProcessHeap () returned 0x1130000 [0057.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0057.856] GetProcessHeap () returned 0x1130000 [0057.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0057.857] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.857] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.857] CloseHandle (hObject=0x3c0) returned 0 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0057.857] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 157 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0057.857] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0057.857] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b30 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.857] GetProcessHeap () returned 0x1130000 [0057.857] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0057.857] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.858] GetProcessHeap () returned 0x1130000 [0057.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.859] GetProcessHeap () returned 0x1130000 [0057.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.860] GetProcessHeap () returned 0x1130000 [0057.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.860] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0057.861] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.861] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.861] CloseHandle (hObject=0x3c0) returned 0 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.861] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 158 [0057.861] GetProcessHeap () returned 0x1130000 [0057.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0057.861] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0057.862] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.862] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b68, Size=0x20) returned 0x1175888 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175b58 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.862] GetProcessHeap () returned 0x1130000 [0057.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.862] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.863] GetProcessHeap () returned 0x1130000 [0057.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.864] GetProcessHeap () returned 0x1130000 [0057.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.864] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.865] GetProcessHeap () returned 0x1130000 [0057.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0057.865] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.865] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.865] CloseHandle (hObject=0x3c0) returned 0 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0057.866] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 159 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0057.866] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.866] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a68 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175a90 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.866] GetProcessHeap () returned 0x1130000 [0057.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.866] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.867] GetProcessHeap () returned 0x1130000 [0057.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.868] GetProcessHeap () returned 0x1130000 [0057.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.869] GetProcessHeap () returned 0x1130000 [0057.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.869] GetProcessHeap () returned 0x1130000 [0057.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0057.870] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.870] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.870] CloseHandle (hObject=0x3c0) returned 0 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.870] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 160 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756d0 [0057.870] SystemFunction036 (in: RandomBuffer=0x11756d0, RandomBufferLength=0x20 | out: RandomBuffer=0x11756d0) returned 1 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.870] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175a90 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0057.870] GetProcessHeap () returned 0x1130000 [0057.870] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175860 [0057.870] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.871] GetProcessHeap () returned 0x1130000 [0057.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.872] GetProcessHeap () returned 0x1130000 [0057.872] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.872] GetProcessHeap () returned 0x1130000 [0057.872] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.872] GetProcessHeap () returned 0x1130000 [0057.872] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.872] GetProcessHeap () returned 0x1130000 [0057.872] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.872] GetProcessHeap () returned 0x1130000 [0057.880] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.880] GetProcessHeap () returned 0x1130000 [0057.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.880] GetProcessHeap () returned 0x1130000 [0057.880] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.880] GetProcessHeap () returned 0x1130000 [0057.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.880] GetProcessHeap () returned 0x1130000 [0057.880] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.880] GetProcessHeap () returned 0x1130000 [0057.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.880] GetProcessHeap () returned 0x1130000 [0057.880] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.880] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a48 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a48 | out: hHeap=0x1130000) returned 1 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.881] GetProcessHeap () returned 0x1130000 [0057.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.881] GetProcessHeap () returned 0x1130000 [0057.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.882] GetProcessHeap () returned 0x1130000 [0057.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0057.883] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.883] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.883] CloseHandle (hObject=0x3c0) returned 0 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.883] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 162 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0057.883] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.883] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.883] GetProcessHeap () returned 0x1130000 [0057.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175888 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175b58 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.884] GetProcessHeap () returned 0x1130000 [0057.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.884] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177808 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177808 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.885] GetProcessHeap () returned 0x1130000 [0057.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0057.885] GetProcessHeap () returned 0x1130000 [0057.886] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.886] GetProcessHeap () returned 0x1130000 [0057.886] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.887] GetProcessHeap () returned 0x1130000 [0057.887] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.887] GetProcessHeap () returned 0x1130000 [0057.888] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0057.888] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.888] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.888] CloseHandle (hObject=0x3c0) returned 0 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0057.888] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 163 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0057.888] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.888] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b68, Size=0x20) returned 0x1175860 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175b08 [0057.888] GetProcessHeap () returned 0x1130000 [0057.888] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.889] GetProcessHeap () returned 0x1130000 [0057.889] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.889] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.890] GetProcessHeap () returned 0x1130000 [0057.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.891] GetProcessHeap () returned 0x1130000 [0057.891] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.892] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.892] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.892] CloseHandle (hObject=0x3c0) returned 0 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0057.892] GetProcessHeap () returned 0x1130000 [0057.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.893] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 164 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0057.893] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.893] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175860 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.893] GetProcessHeap () returned 0x1130000 [0057.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.894] GetProcessHeap () returned 0x1130000 [0057.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.894] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.895] GetProcessHeap () returned 0x1130000 [0057.895] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.895] GetProcessHeap () returned 0x1130000 [0057.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.896] GetProcessHeap () returned 0x1130000 [0057.896] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.896] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.897] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.897] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.897] CloseHandle (hObject=0x3c0) returned 0 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.897] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 165 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0057.897] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.897] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175900 [0057.897] GetProcessHeap () returned 0x1130000 [0057.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175798 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.898] GetProcessHeap () returned 0x1130000 [0057.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.899] GetProcessHeap () returned 0x1130000 [0057.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.900] GetProcessHeap () returned 0x1130000 [0057.900] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0057.901] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.901] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.901] CloseHandle (hObject=0x3c0) returned 0 [0057.901] GetProcessHeap () returned 0x1130000 [0057.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.902] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 166 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0057.902] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.902] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11756f8 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x11759a0 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.902] GetProcessHeap () returned 0x1130000 [0057.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.903] GetProcessHeap () returned 0x1130000 [0057.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.903] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779b8 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779b8 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.904] GetProcessHeap () returned 0x1130000 [0057.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.905] GetProcessHeap () returned 0x1130000 [0057.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0057.906] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.906] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.906] CloseHandle (hObject=0x3c0) returned 0 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.906] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 167 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0057.906] GetProcessHeap () returned 0x1130000 [0057.906] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0057.906] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0057.906] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.907] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11756d0 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11758b0 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.907] GetProcessHeap () returned 0x1130000 [0057.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.907] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0057.908] GetProcessHeap () returned 0x1130000 [0057.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.908] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.909] GetProcessHeap () returned 0x1130000 [0057.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.909] GetProcessHeap () returned 0x1130000 [0057.910] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.910] GetProcessHeap () returned 0x1130000 [0057.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0057.911] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.911] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.911] CloseHandle (hObject=0x3c0) returned 0 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0057.911] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 168 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0057.911] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.911] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175ba8 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175a40 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.911] GetProcessHeap () returned 0x1130000 [0057.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.912] GetProcessHeap () returned 0x1130000 [0057.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.912] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a78 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e010 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a78 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e010 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.913] GetProcessHeap () returned 0x1130000 [0057.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.914] GetProcessHeap () returned 0x1130000 [0057.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0057.915] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.915] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.915] CloseHandle (hObject=0x3c0) returned 0 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.915] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 169 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175978 [0057.915] SystemFunction036 (in: RandomBuffer=0x1175978, RandomBufferLength=0x20 | out: RandomBuffer=0x1175978) returned 1 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.915] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.915] GetProcessHeap () returned 0x1130000 [0057.915] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175900 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175ab8 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.916] GetProcessHeap () returned 0x1130000 [0057.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.916] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e328 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e328 | out: hHeap=0x1130000) returned 1 [0057.917] GetProcessHeap () returned 0x1130000 [0057.917] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.917] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.918] GetProcessHeap () returned 0x1130000 [0057.918] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.919] GetProcessHeap () returned 0x1130000 [0057.919] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.919] GetProcessHeap () returned 0x1130000 [0057.919] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.967] GetProcessHeap () returned 0x1130000 [0057.967] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0057.967] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.967] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.968] CloseHandle (hObject=0x3c0) returned 0 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.968] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 171 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0057.968] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.968] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x11756f8 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175798 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.968] GetProcessHeap () returned 0x1130000 [0057.968] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.969] GetProcessHeap () returned 0x1130000 [0057.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.969] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.970] GetProcessHeap () returned 0x1130000 [0057.970] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.971] GetProcessHeap () returned 0x1130000 [0057.971] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.971] GetProcessHeap () returned 0x1130000 [0057.972] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0057.972] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.972] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.972] CloseHandle (hObject=0x3c0) returned 0 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0057.972] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 172 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0057.972] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0057.972] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175770 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0057.972] GetProcessHeap () returned 0x1130000 [0057.972] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175a18 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.973] GetProcessHeap () returned 0x1130000 [0057.973] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.973] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a78 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a78 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.974] GetProcessHeap () returned 0x1130000 [0057.974] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.974] GetProcessHeap () returned 0x1130000 [0057.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.975] GetProcessHeap () returned 0x1130000 [0057.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.975] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0057.976] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.976] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.976] CloseHandle (hObject=0x3c0) returned 0 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.976] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 173 [0057.976] GetProcessHeap () returned 0x1130000 [0057.976] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0057.977] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.977] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b30 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175b58 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.977] GetProcessHeap () returned 0x1130000 [0057.977] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e010 [0057.978] GetProcessHeap () returned 0x1130000 [0057.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0057.978] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e010 | out: hHeap=0x1130000) returned 1 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.979] GetProcessHeap () returned 0x1130000 [0057.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.980] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.980] GetProcessHeap () returned 0x1130000 [0057.981] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0057.981] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.981] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.981] CloseHandle (hObject=0x3c0) returned 0 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.981] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 174 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0057.981] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0057.981] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175888 [0057.981] GetProcessHeap () returned 0x1130000 [0057.981] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.982] GetProcessHeap () returned 0x1130000 [0057.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.982] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779b8 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779b8 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0057.983] GetProcessHeap () returned 0x1130000 [0057.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x121ece0 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.984] GetProcessHeap () returned 0x1130000 [0057.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0057.985] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.985] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.985] CloseHandle (hObject=0x3c0) returned 0 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0057.985] GetProcessHeap () returned 0x1130000 [0057.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.986] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 175 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0057.986] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0057.986] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x11758d8 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175900 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.986] GetProcessHeap () returned 0x1130000 [0057.986] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.987] GetProcessHeap () returned 0x1130000 [0057.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.988] GetProcessHeap () returned 0x1130000 [0057.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.989] GetProcessHeap () returned 0x1130000 [0057.990] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0057.990] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.990] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.990] CloseHandle (hObject=0x3c0) returned 0 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0057.990] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 176 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0057.990] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.990] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x1175a18 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.990] GetProcessHeap () returned 0x1130000 [0057.990] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.990] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.991] GetProcessHeap () returned 0x1130000 [0057.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.991] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e328 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e328 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.992] GetProcessHeap () returned 0x1130000 [0057.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.993] GetProcessHeap () returned 0x1130000 [0057.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0057.994] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.994] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.994] CloseHandle (hObject=0x3c0) returned 0 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.994] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 177 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0057.994] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0057.994] GetProcessHeap () returned 0x1130000 [0057.994] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.994] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175950 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.995] GetProcessHeap () returned 0x1130000 [0057.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.995] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.996] GetProcessHeap () returned 0x1130000 [0057.996] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0057.996] GetProcessHeap () returned 0x1130000 [0057.997] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.997] GetProcessHeap () returned 0x1130000 [0057.997] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.998] GetProcessHeap () returned 0x1130000 [0057.998] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0057.999] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.999] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0057.999] CloseHandle (hObject=0x3c0) returned 0 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.999] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 178 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0057.999] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.999] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0057.999] GetProcessHeap () returned 0x1130000 [0057.999] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.999] GetProcessHeap () returned 0x1130000 [0058.000] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.000] GetProcessHeap () returned 0x1130000 [0058.000] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.000] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b08 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b08 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.001] GetProcessHeap () returned 0x1130000 [0058.001] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.002] GetProcessHeap () returned 0x1130000 [0058.002] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.002] GetProcessHeap () returned 0x1130000 [0058.003] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.003] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.003] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.003] CloseHandle (hObject=0x3c0) returned 0 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.003] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 179 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.003] GetProcessHeap () returned 0x1130000 [0058.003] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175978 [0058.003] SystemFunction036 (in: RandomBuffer=0x1175978, RandomBufferLength=0x20 | out: RandomBuffer=0x1175978) returned 1 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.004] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175860 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.004] GetProcessHeap () returned 0x1130000 [0058.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.004] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b08 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b08 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0058.005] GetProcessHeap () returned 0x1130000 [0058.005] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.006] GetProcessHeap () returned 0x1130000 [0058.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.007] GetProcessHeap () returned 0x1130000 [0058.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.007] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.007] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.008] CloseHandle (hObject=0x3c0) returned 0 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.008] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 180 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.008] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.008] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175798 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.008] GetProcessHeap () returned 0x1130000 [0058.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.009] GetProcessHeap () returned 0x1130000 [0058.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.009] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.010] GetProcessHeap () returned 0x1130000 [0058.010] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.011] GetProcessHeap () returned 0x1130000 [0058.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.011] GetProcessHeap () returned 0x1130000 [0058.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.012] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.012] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.012] CloseHandle (hObject=0x3c0) returned 0 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.012] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 181 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.012] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.012] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.012] GetProcessHeap () returned 0x1130000 [0058.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.012] GetProcessHeap () returned 0x1130000 [0058.128] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ab8 [0058.128] GetProcessHeap () returned 0x1130000 [0058.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.128] GetProcessHeap () returned 0x1130000 [0058.128] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11757c0 [0058.128] GetProcessHeap () returned 0x1130000 [0058.128] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.128] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.129] GetProcessHeap () returned 0x1130000 [0058.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.129] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177ad8 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e010 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177ad8 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e010 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x121ece0 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.130] GetProcessHeap () returned 0x1130000 [0058.130] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.131] GetProcessHeap () returned 0x1130000 [0058.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.132] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.132] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.132] CloseHandle (hObject=0x3c0) returned 0 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.132] GetProcessHeap () returned 0x1130000 [0058.132] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.132] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 183 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.133] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.133] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175720 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175860 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.133] GetProcessHeap () returned 0x1130000 [0058.133] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a78 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.134] GetProcessHeap () returned 0x1130000 [0058.134] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0058.134] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a78 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.135] GetProcessHeap () returned 0x1130000 [0058.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.136] GetProcessHeap () returned 0x1130000 [0058.136] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.137] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.137] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.137] CloseHandle (hObject=0x3c0) returned 0 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.137] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 184 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.137] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.137] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175978 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.137] GetProcessHeap () returned 0x1130000 [0058.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.138] GetProcessHeap () returned 0x1130000 [0058.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.139] GetProcessHeap () returned 0x1130000 [0058.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.140] GetProcessHeap () returned 0x1130000 [0058.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0058.141] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.141] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.141] CloseHandle (hObject=0x3c0) returned 0 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.141] GetProcessHeap () returned 0x1130000 [0058.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.142] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 185 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.142] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.142] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175978 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175928 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.142] GetProcessHeap () returned 0x1130000 [0058.142] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.142] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.143] GetProcessHeap () returned 0x1130000 [0058.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.144] GetProcessHeap () returned 0x1130000 [0058.144] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.145] GetProcessHeap () returned 0x1130000 [0058.146] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0058.146] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.146] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.146] CloseHandle (hObject=0x3c0) returned 0 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.146] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 186 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756d0 [0058.146] SystemFunction036 (in: RandomBuffer=0x11756d0, RandomBufferLength=0x20 | out: RandomBuffer=0x11756d0) returned 1 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.146] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x1175ab8 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.146] GetProcessHeap () returned 0x1130000 [0058.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.146] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.147] GetProcessHeap () returned 0x1130000 [0058.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b38 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b38 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.148] GetProcessHeap () returned 0x1130000 [0058.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.149] GetProcessHeap () returned 0x1130000 [0058.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.150] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.150] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.150] CloseHandle (hObject=0x3c0) returned 0 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.150] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 187 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.150] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.150] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.150] GetProcessHeap () returned 0x1130000 [0058.150] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150af8, Size=0x20) returned 0x1175ae0 [0058.150] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x11758b0 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.151] GetProcessHeap () returned 0x1130000 [0058.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177838 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177838 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x121ece0 [0058.152] GetProcessHeap () returned 0x1130000 [0058.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.153] GetProcessHeap () returned 0x1130000 [0058.153] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.154] GetProcessHeap () returned 0x1130000 [0058.154] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.155] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.155] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.155] CloseHandle (hObject=0x3c0) returned 0 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.155] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 188 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0058.155] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.155] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175b08 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175b30 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.155] GetProcessHeap () returned 0x1130000 [0058.155] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.155] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.156] GetProcessHeap () returned 0x1130000 [0058.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.156] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177838 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177838 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.157] GetProcessHeap () returned 0x1130000 [0058.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.158] GetProcessHeap () returned 0x1130000 [0058.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.159] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.159] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.159] CloseHandle (hObject=0x3c0) returned 0 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.159] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 189 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.159] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.159] GetProcessHeap () returned 0x1130000 [0058.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.159] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.159] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175a18 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175a40 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.160] GetProcessHeap () returned 0x1130000 [0058.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177838 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177838 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0058.161] GetProcessHeap () returned 0x1130000 [0058.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.161] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.162] GetProcessHeap () returned 0x1130000 [0058.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.163] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.163] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.163] CloseHandle (hObject=0x3c0) returned 0 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.163] GetProcessHeap () returned 0x1130000 [0058.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.164] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 190 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.164] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.164] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175770 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11758d8 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.164] GetProcessHeap () returned 0x1130000 [0058.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.164] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0058.165] GetProcessHeap () returned 0x1130000 [0058.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.166] GetProcessHeap () returned 0x1130000 [0058.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.167] GetProcessHeap () returned 0x1130000 [0058.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.167] GetProcessHeap () returned 0x1130000 [0058.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.168] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.168] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.168] CloseHandle (hObject=0x3c0) returned 0 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.168] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 191 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.168] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.168] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x11759a0 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.168] GetProcessHeap () returned 0x1130000 [0058.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.168] GetProcessHeap () returned 0x1130000 [0058.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.169] GetProcessHeap () returned 0x1130000 [0058.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.169] GetProcessHeap () returned 0x1130000 [0058.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.176] GetProcessHeap () returned 0x1130000 [0058.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0058.177] GetProcessHeap () returned 0x1130000 [0058.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.177] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.178] GetProcessHeap () returned 0x1130000 [0058.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.179] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.179] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.179] CloseHandle (hObject=0x3c0) returned 0 [0058.179] GetProcessHeap () returned 0x1130000 [0058.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.179] GetProcessHeap () returned 0x1130000 [0058.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.180] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 193 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.180] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.180] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a40 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175798 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.180] GetProcessHeap () returned 0x1130000 [0058.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.181] GetProcessHeap () returned 0x1130000 [0058.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.181] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a18 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a18 | out: hHeap=0x1130000) returned 1 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.182] GetProcessHeap () returned 0x1130000 [0058.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.183] GetProcessHeap () returned 0x1130000 [0058.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.184] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.184] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.184] CloseHandle (hObject=0x3c0) returned 0 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.184] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 194 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.184] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.184] GetProcessHeap () returned 0x1130000 [0058.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.184] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b08 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ba8 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.185] GetProcessHeap () returned 0x1130000 [0058.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.185] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0058.186] GetProcessHeap () returned 0x1130000 [0058.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.187] GetProcessHeap () returned 0x1130000 [0058.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.187] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.188] GetProcessHeap () returned 0x1130000 [0058.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.188] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.188] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.188] CloseHandle (hObject=0x3c0) returned 0 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.189] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 195 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.189] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.189] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175ba8 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175860 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.189] GetProcessHeap () returned 0x1130000 [0058.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.189] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.190] GetProcessHeap () returned 0x1130000 [0058.190] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.190] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x121ece0 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.191] GetProcessHeap () returned 0x1130000 [0058.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.192] GetProcessHeap () returned 0x1130000 [0058.192] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.193] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.193] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.193] CloseHandle (hObject=0x3c0) returned 0 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.193] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 196 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0058.193] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.193] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175a90 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x11757c0 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.193] GetProcessHeap () returned 0x1130000 [0058.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.194] GetProcessHeap () returned 0x1130000 [0058.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.194] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177988 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177988 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.195] GetProcessHeap () returned 0x1130000 [0058.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.196] GetProcessHeap () returned 0x1130000 [0058.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0058.197] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.197] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.197] CloseHandle (hObject=0x3c0) returned 0 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.197] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 197 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.197] GetProcessHeap () returned 0x1130000 [0058.197] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.197] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.198] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175b30 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.198] GetProcessHeap () returned 0x1130000 [0058.198] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0058.199] GetProcessHeap () returned 0x1130000 [0058.199] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.199] GetProcessHeap () returned 0x1130000 [0058.200] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.200] GetProcessHeap () returned 0x1130000 [0058.200] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.201] GetProcessHeap () returned 0x1130000 [0058.201] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.201] GetProcessHeap () returned 0x1130000 [0058.202] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.202] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.202] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.202] CloseHandle (hObject=0x3c0) returned 0 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.202] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 198 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.202] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.202] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.202] GetProcessHeap () returned 0x1130000 [0058.202] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.202] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.203] GetProcessHeap () returned 0x1130000 [0058.203] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.204] GetProcessHeap () returned 0x1130000 [0058.204] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.205] GetProcessHeap () returned 0x1130000 [0058.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.206] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.206] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.206] CloseHandle (hObject=0x3c0) returned 0 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.206] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 199 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.206] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.206] GetProcessHeap () returned 0x1130000 [0058.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.206] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.207] GetProcessHeap () returned 0x1130000 [0058.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.207] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.208] GetProcessHeap () returned 0x1130000 [0058.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.209] GetProcessHeap () returned 0x1130000 [0058.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0058.210] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.210] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.210] CloseHandle (hObject=0x3c0) returned 0 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.210] GetProcessHeap () returned 0x1130000 [0058.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.211] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 200 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.211] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.211] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175ae0 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.211] GetProcessHeap () returned 0x1130000 [0058.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.212] GetProcessHeap () returned 0x1130000 [0058.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e208 [0058.212] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e208 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.213] GetProcessHeap () returned 0x1130000 [0058.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.214] GetProcessHeap () returned 0x1130000 [0058.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.215] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.215] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.215] CloseHandle (hObject=0x3c0) returned 0 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.215] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 201 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0058.215] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.215] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x11759a0 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175888 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.215] GetProcessHeap () returned 0x1130000 [0058.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.215] GetProcessHeap () returned 0x1130000 [0058.230] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.230] GetProcessHeap () returned 0x1130000 [0058.230] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.235] GetProcessHeap () returned 0x1130000 [0058.237] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.237] GetProcessHeap () returned 0x1130000 [0058.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.253] GetProcessHeap () returned 0x1130000 [0058.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.278] GetProcessHeap () returned 0x1130000 [0058.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.278] GetProcessHeap () returned 0x1130000 [0058.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.278] GetProcessHeap () returned 0x1130000 [0058.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.278] GetProcessHeap () returned 0x1130000 [0058.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.278] GetProcessHeap () returned 0x1130000 [0058.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.278] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177aa8 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177aa8 | out: hHeap=0x1130000) returned 1 [0058.279] GetProcessHeap () returned 0x1130000 [0058.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.280] GetProcessHeap () returned 0x1130000 [0058.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.281] GetProcessHeap () returned 0x1130000 [0058.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.281] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.282] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.282] CloseHandle (hObject=0x3c0) returned 0 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.282] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 203 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.282] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.282] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175900 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11759c8 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.282] GetProcessHeap () returned 0x1130000 [0058.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.283] GetProcessHeap () returned 0x1130000 [0058.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a18 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a18 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.284] GetProcessHeap () returned 0x1130000 [0058.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.284] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.285] GetProcessHeap () returned 0x1130000 [0058.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.285] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0058.286] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.286] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.286] CloseHandle (hObject=0x3c0) returned 0 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.286] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 204 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.286] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.286] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.286] GetProcessHeap () returned 0x1130000 [0058.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.286] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175928 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175ab8 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.287] GetProcessHeap () returned 0x1130000 [0058.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.287] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a48 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a48 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0058.288] GetProcessHeap () returned 0x1130000 [0058.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.289] GetProcessHeap () returned 0x1130000 [0058.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.289] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.290] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.290] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.290] CloseHandle (hObject=0x3c0) returned 0 [0058.290] GetProcessHeap () returned 0x1130000 [0058.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.290] GetProcessHeap () returned 0x1130000 [0058.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.291] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 205 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.291] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.291] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175928 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x11756f8 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.291] GetProcessHeap () returned 0x1130000 [0058.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.291] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.292] GetProcessHeap () returned 0x1130000 [0058.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b08 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b08 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.293] GetProcessHeap () returned 0x1130000 [0058.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.294] GetProcessHeap () returned 0x1130000 [0058.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.294] GetProcessHeap () returned 0x1130000 [0058.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.295] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.295] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.295] CloseHandle (hObject=0x3c0) returned 0 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.295] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 206 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.295] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.295] GetProcessHeap () returned 0x1130000 [0058.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.295] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11759c8 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.296] GetProcessHeap () returned 0x1130000 [0058.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.296] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0058.297] GetProcessHeap () returned 0x1130000 [0058.297] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.298] GetProcessHeap () returned 0x1130000 [0058.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.299] GetProcessHeap () returned 0x1130000 [0058.299] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.299] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.299] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.299] CloseHandle (hObject=0x3c0) returned 0 [0058.299] GetProcessHeap () returned 0x1130000 [0058.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.300] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 207 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0058.300] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.300] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ab8 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.300] GetProcessHeap () returned 0x1130000 [0058.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.301] GetProcessHeap () returned 0x1130000 [0058.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.301] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a48 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a48 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.302] GetProcessHeap () returned 0x1130000 [0058.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.303] GetProcessHeap () returned 0x1130000 [0058.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.303] GetProcessHeap () returned 0x1130000 [0058.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.304] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.304] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.304] CloseHandle (hObject=0x3c0) returned 0 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.304] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 208 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.304] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.304] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x11758d8 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175928 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.304] GetProcessHeap () returned 0x1130000 [0058.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.304] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.305] GetProcessHeap () returned 0x1130000 [0058.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de60 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de60 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.306] GetProcessHeap () returned 0x1130000 [0058.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.307] GetProcessHeap () returned 0x1130000 [0058.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.307] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.308] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.308] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.308] CloseHandle (hObject=0x3c0) returned 0 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.308] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 209 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.308] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.308] GetProcessHeap () returned 0x1130000 [0058.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.308] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ae0 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175a18 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.309] GetProcessHeap () returned 0x1130000 [0058.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.309] GetProcessHeap () returned 0x1130000 [0058.332] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.333] GetProcessHeap () returned 0x1130000 [0058.333] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.333] GetProcessHeap () returned 0x1130000 [0058.334] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.334] GetProcessHeap () returned 0x1130000 [0058.334] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.337] GetProcessHeap () returned 0x1130000 [0058.337] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.339] GetProcessHeap () returned 0x1130000 [0058.339] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.342] GetProcessHeap () returned 0x1130000 [0058.342] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.342] GetProcessHeap () returned 0x1130000 [0058.342] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.342] GetProcessHeap () returned 0x1130000 [0058.346] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.354] GetProcessHeap () returned 0x1130000 [0058.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.355] GetProcessHeap () returned 0x1130000 [0058.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.355] GetProcessHeap () returned 0x1130000 [0058.356] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.356] GetProcessHeap () returned 0x1130000 [0058.356] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.357] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.357] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.357] CloseHandle (hObject=0x3c0) returned 0 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.357] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 211 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.357] GetProcessHeap () returned 0x1130000 [0058.357] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759c8 [0058.357] SystemFunction036 (in: RandomBuffer=0x11759c8, RandomBufferLength=0x20 | out: RandomBuffer=0x11759c8) returned 1 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.358] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175ae0 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.358] GetProcessHeap () returned 0x1130000 [0058.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0058.358] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e2e0 [0058.359] GetProcessHeap () returned 0x1130000 [0058.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0058.359] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e2e0 | out: hHeap=0x1130000) returned 1 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.360] GetProcessHeap () returned 0x1130000 [0058.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.361] GetProcessHeap () returned 0x1130000 [0058.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.361] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.362] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.362] CloseHandle (hObject=0x3c0) returned 0 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.362] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 212 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.362] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.362] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c98, Size=0x20) returned 0x1175ae0 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x11759a0 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.362] GetProcessHeap () returned 0x1130000 [0058.362] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.363] GetProcessHeap () returned 0x1130000 [0058.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779b8 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779b8 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.364] GetProcessHeap () returned 0x1130000 [0058.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.364] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.365] GetProcessHeap () returned 0x1130000 [0058.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.366] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.366] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.366] CloseHandle (hObject=0x3c0) returned 0 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.366] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 213 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.366] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.366] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11756f8 [0058.366] GetProcessHeap () returned 0x1130000 [0058.366] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175720 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.367] GetProcessHeap () returned 0x1130000 [0058.367] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.367] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.368] GetProcessHeap () returned 0x1130000 [0058.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.368] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.369] GetProcessHeap () returned 0x1130000 [0058.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.369] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.370] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.370] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.370] CloseHandle (hObject=0x3c0) returned 0 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.370] GetProcessHeap () returned 0x1130000 [0058.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.370] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 214 [0058.370] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.371] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.371] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175748 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175b08 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.371] GetProcessHeap () returned 0x1130000 [0058.371] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.372] GetProcessHeap () returned 0x1130000 [0058.372] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.373] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.373] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.373] CloseHandle (hObject=0x3c0) returned 0 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.373] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 215 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.373] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.373] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.373] GetProcessHeap () returned 0x1130000 [0058.373] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.374] GetProcessHeap () returned 0x1130000 [0058.374] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x11759a0 [0058.374] GetProcessHeap () returned 0x1130000 [0058.374] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.374] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.374] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.374] CloseHandle (hObject=0x3c0) returned 0 [0058.374] GetProcessHeap () returned 0x1130000 [0058.374] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.374] GetProcessHeap () returned 0x1130000 [0058.374] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.374] GetProcessHeap () returned 0x1130000 [0058.374] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.374] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 216 [0058.374] GetProcessHeap () returned 0x1130000 [0058.374] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.374] GetProcessHeap () returned 0x1130000 [0058.374] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.374] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.375] GetProcessHeap () returned 0x1130000 [0058.375] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.375] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.375] GetProcessHeap () returned 0x1130000 [0058.375] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.375] GetProcessHeap () returned 0x1130000 [0058.375] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.375] GetProcessHeap () returned 0x1130000 [0058.375] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.375] GetProcessHeap () returned 0x1130000 [0058.375] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.375] GetProcessHeap () returned 0x1130000 [0058.375] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11758b0 [0058.375] GetProcessHeap () returned 0x1130000 [0058.375] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.375] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.375] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.375] CloseHandle (hObject=0x3c0) returned 0 [0058.375] GetProcessHeap () returned 0x1130000 [0058.375] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.376] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 217 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.376] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.376] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x11759c8 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175b30 [0058.376] GetProcessHeap () returned 0x1130000 [0058.376] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.377] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.377] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.377] CloseHandle (hObject=0x3c0) returned 0 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.377] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 218 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0058.377] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.377] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bf8, Size=0x20) returned 0x1175860 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x11756d0 [0058.377] GetProcessHeap () returned 0x1130000 [0058.377] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.378] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.378] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.378] CloseHandle (hObject=0x3c0) returned 0 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.378] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 219 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0058.378] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.378] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175978 [0058.378] GetProcessHeap () returned 0x1130000 [0058.378] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.379] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.379] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.379] CloseHandle (hObject=0x3c0) returned 0 [0058.379] GetProcessHeap () returned 0x1130000 [0058.379] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.379] GetProcessHeap () returned 0x1130000 [0058.379] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0058.379] GetProcessHeap () returned 0x1130000 [0058.379] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.379] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 220 [0058.379] GetProcessHeap () returned 0x1130000 [0058.379] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.379] GetProcessHeap () returned 0x1130000 [0058.379] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.379] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.379] GetProcessHeap () returned 0x1130000 [0058.379] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.379] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175a68 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175a18 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.380] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.380] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.380] CloseHandle (hObject=0x3c0) returned 0 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.380] GetProcessHeap () returned 0x1130000 [0058.380] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.380] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 221 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.381] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.381] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175860 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175720 [0058.381] GetProcessHeap () returned 0x1130000 [0058.381] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.381] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.381] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.382] CloseHandle (hObject=0x3c0) returned 0 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.382] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 222 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.382] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.382] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175b58 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175860 [0058.382] GetProcessHeap () returned 0x1130000 [0058.382] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.383] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.383] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.383] CloseHandle (hObject=0x3c0) returned 0 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.383] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 223 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.383] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.383] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b08 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0058.383] GetProcessHeap () returned 0x1130000 [0058.383] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.384] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.384] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.384] CloseHandle (hObject=0x3c0) returned 0 [0058.384] GetProcessHeap () returned 0x1130000 [0058.384] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.384] GetProcessHeap () returned 0x1130000 [0058.384] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.384] GetProcessHeap () returned 0x1130000 [0058.384] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.384] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 224 [0058.384] GetProcessHeap () returned 0x1130000 [0058.384] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.384] GetProcessHeap () returned 0x1130000 [0058.384] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0058.384] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0058.384] GetProcessHeap () returned 0x1130000 [0058.384] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.384] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.384] GetProcessHeap () returned 0x1130000 [0058.385] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.385] GetProcessHeap () returned 0x1130000 [0058.385] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.385] GetProcessHeap () returned 0x1130000 [0058.385] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0058.385] GetProcessHeap () returned 0x1130000 [0058.385] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.385] GetProcessHeap () returned 0x1130000 [0058.385] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b30 [0058.385] GetProcessHeap () returned 0x1130000 [0058.385] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.385] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.385] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.385] CloseHandle (hObject=0x3c0) returned 0 [0058.385] GetProcessHeap () returned 0x1130000 [0058.385] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.385] GetProcessHeap () returned 0x1130000 [0058.385] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0058.385] GetProcessHeap () returned 0x1130000 [0058.385] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.385] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 225 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.386] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.386] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175798 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175888 [0058.386] GetProcessHeap () returned 0x1130000 [0058.386] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.387] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.387] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.387] CloseHandle (hObject=0x3c0) returned 0 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.387] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 226 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.387] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.387] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x11759a0 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.387] GetProcessHeap () returned 0x1130000 [0058.387] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175a68 [0058.387] GetProcessHeap () returned 0x1130000 [0058.405] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.428] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.428] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.429] CloseHandle (hObject=0x3c0) returned 0 [0058.429] GetProcessHeap () returned 0x1130000 [0058.429] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.429] GetProcessHeap () returned 0x1130000 [0058.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.430] GetProcessHeap () returned 0x1130000 [0058.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.432] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 228 [0058.433] GetProcessHeap () returned 0x1130000 [0058.433] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.433] GetProcessHeap () returned 0x1130000 [0058.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0058.444] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0058.444] GetProcessHeap () returned 0x1130000 [0058.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.444] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.444] GetProcessHeap () returned 0x1130000 [0058.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.444] GetProcessHeap () returned 0x1130000 [0058.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.444] GetProcessHeap () returned 0x1130000 [0058.444] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175888 [0058.444] GetProcessHeap () returned 0x1130000 [0058.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.444] GetProcessHeap () returned 0x1130000 [0058.444] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175a90 [0058.445] GetProcessHeap () returned 0x1130000 [0058.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.445] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.445] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.445] CloseHandle (hObject=0x3c0) returned 0 [0058.445] GetProcessHeap () returned 0x1130000 [0058.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.445] GetProcessHeap () returned 0x1130000 [0058.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0058.445] GetProcessHeap () returned 0x1130000 [0058.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.445] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 229 [0058.445] GetProcessHeap () returned 0x1130000 [0058.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.445] GetProcessHeap () returned 0x1130000 [0058.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0058.445] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0058.445] GetProcessHeap () returned 0x1130000 [0058.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.446] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.446] GetProcessHeap () returned 0x1130000 [0058.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.446] GetProcessHeap () returned 0x1130000 [0058.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.446] GetProcessHeap () returned 0x1130000 [0058.446] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175a18 [0058.446] GetProcessHeap () returned 0x1130000 [0058.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.446] GetProcessHeap () returned 0x1130000 [0058.446] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175888 [0058.446] GetProcessHeap () returned 0x1130000 [0058.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.446] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.446] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.446] CloseHandle (hObject=0x3c0) returned 0 [0058.446] GetProcessHeap () returned 0x1130000 [0058.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.446] GetProcessHeap () returned 0x1130000 [0058.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.446] GetProcessHeap () returned 0x1130000 [0058.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.447] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 230 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.447] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.447] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175ab8 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175860 [0058.447] GetProcessHeap () returned 0x1130000 [0058.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.448] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.448] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.448] CloseHandle (hObject=0x3c0) returned 0 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.448] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 231 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.448] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.448] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175798 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175860 [0058.448] GetProcessHeap () returned 0x1130000 [0058.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.449] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.449] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.449] CloseHandle (hObject=0x3c0) returned 0 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.449] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 232 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.449] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.449] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175a18 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175900 [0058.449] GetProcessHeap () returned 0x1130000 [0058.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.450] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.450] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.450] CloseHandle (hObject=0x3c0) returned 0 [0058.450] GetProcessHeap () returned 0x1130000 [0058.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.450] GetProcessHeap () returned 0x1130000 [0058.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.451] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 233 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.451] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.451] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175b58 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11756f8 [0058.451] GetProcessHeap () returned 0x1130000 [0058.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.452] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.452] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.452] CloseHandle (hObject=0x3c0) returned 0 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.452] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 234 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756d0 [0058.452] SystemFunction036 (in: RandomBuffer=0x11756d0, RandomBufferLength=0x20 | out: RandomBuffer=0x11756d0) returned 1 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.452] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bf8, Size=0x20) returned 0x1175950 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11756f8 [0058.452] GetProcessHeap () returned 0x1130000 [0058.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.453] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.453] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.453] CloseHandle (hObject=0x3c0) returned 0 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.453] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 235 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0058.453] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.453] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x11758d8 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175ba8 [0058.453] GetProcessHeap () returned 0x1130000 [0058.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.454] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.454] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.454] CloseHandle (hObject=0x3c0) returned 0 [0058.454] GetProcessHeap () returned 0x1130000 [0058.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.454] GetProcessHeap () returned 0x1130000 [0058.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.454] GetProcessHeap () returned 0x1130000 [0058.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.454] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 236 [0058.454] GetProcessHeap () returned 0x1130000 [0058.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.454] GetProcessHeap () returned 0x1130000 [0058.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.454] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.454] GetProcessHeap () returned 0x1130000 [0058.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.454] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.454] GetProcessHeap () returned 0x1130000 [0058.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.454] GetProcessHeap () returned 0x1130000 [0058.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.455] GetProcessHeap () returned 0x1130000 [0058.455] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.455] GetProcessHeap () returned 0x1130000 [0058.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.455] GetProcessHeap () returned 0x1130000 [0058.455] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175900 [0058.455] GetProcessHeap () returned 0x1130000 [0058.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.455] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.455] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.455] CloseHandle (hObject=0x3c0) returned 0 [0058.455] GetProcessHeap () returned 0x1130000 [0058.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.455] GetProcessHeap () returned 0x1130000 [0058.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.455] GetProcessHeap () returned 0x1130000 [0058.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.455] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 237 [0058.455] GetProcessHeap () returned 0x1130000 [0058.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.455] GetProcessHeap () returned 0x1130000 [0058.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0058.456] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0058.456] GetProcessHeap () returned 0x1130000 [0058.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.456] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.456] GetProcessHeap () returned 0x1130000 [0058.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.456] GetProcessHeap () returned 0x1130000 [0058.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.456] GetProcessHeap () returned 0x1130000 [0058.456] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175928 [0058.456] GetProcessHeap () returned 0x1130000 [0058.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.456] GetProcessHeap () returned 0x1130000 [0058.456] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x11756f8 [0058.456] GetProcessHeap () returned 0x1130000 [0058.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.456] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.456] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.456] CloseHandle (hObject=0x3c0) returned 0 [0058.456] GetProcessHeap () returned 0x1130000 [0058.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.457] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 238 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.457] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.457] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a40 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175770 [0058.457] GetProcessHeap () returned 0x1130000 [0058.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.458] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.458] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.458] CloseHandle (hObject=0x3c0) returned 0 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.458] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 239 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.458] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.458] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175a18 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175b30 [0058.458] GetProcessHeap () returned 0x1130000 [0058.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.459] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.459] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.459] CloseHandle (hObject=0x3b0) returned 0 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.459] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 240 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0058.459] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.459] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11756d0 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175888 [0058.459] GetProcessHeap () returned 0x1130000 [0058.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.460] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.460] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.460] CloseHandle (hObject=0x3b0) returned 0 [0058.460] GetProcessHeap () returned 0x1130000 [0058.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.460] GetProcessHeap () returned 0x1130000 [0058.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0058.460] GetProcessHeap () returned 0x1130000 [0058.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.460] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 241 [0058.460] GetProcessHeap () returned 0x1130000 [0058.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.460] GetProcessHeap () returned 0x1130000 [0058.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.460] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.460] GetProcessHeap () returned 0x1130000 [0058.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.460] ReadFile (in: hFile=0x3b0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.460] GetProcessHeap () returned 0x1130000 [0058.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.460] GetProcessHeap () returned 0x1130000 [0058.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.461] GetProcessHeap () returned 0x1130000 [0058.461] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11757c0 [0058.461] GetProcessHeap () returned 0x1130000 [0058.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.461] GetProcessHeap () returned 0x1130000 [0058.461] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11758d8 [0058.461] GetProcessHeap () returned 0x1130000 [0058.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.461] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.461] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.461] CloseHandle (hObject=0x3b0) returned 0 [0058.461] GetProcessHeap () returned 0x1130000 [0058.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.461] GetProcessHeap () returned 0x1130000 [0058.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.461] GetProcessHeap () returned 0x1130000 [0058.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.461] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 242 [0058.461] GetProcessHeap () returned 0x1130000 [0058.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.461] GetProcessHeap () returned 0x1130000 [0058.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.462] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.462] GetProcessHeap () returned 0x1130000 [0058.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.462] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.462] GetProcessHeap () returned 0x1130000 [0058.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.462] GetProcessHeap () returned 0x1130000 [0058.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.462] GetProcessHeap () returned 0x1130000 [0058.462] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175b58 [0058.462] GetProcessHeap () returned 0x1130000 [0058.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.462] GetProcessHeap () returned 0x1130000 [0058.462] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0058.462] GetProcessHeap () returned 0x1130000 [0058.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.462] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.462] WriteFile (in: hFile=0x3b0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.462] CloseHandle (hObject=0x3b0) returned 0 [0058.462] GetProcessHeap () returned 0x1130000 [0058.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.463] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 243 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0058.463] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.463] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a40 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.463] GetProcessHeap () returned 0x1130000 [0058.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.464] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.464] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.464] CloseHandle (hObject=0x3b0) returned 0 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.464] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 244 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.464] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.464] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175860 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0058.464] GetProcessHeap () returned 0x1130000 [0058.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.465] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.465] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.465] CloseHandle (hObject=0x3b0) returned 0 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.465] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 245 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.465] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.465] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b30 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.465] GetProcessHeap () returned 0x1130000 [0058.465] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0058.466] GetProcessHeap () returned 0x1130000 [0058.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.466] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.466] WriteFile (in: hFile=0x3b0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.466] CloseHandle (hObject=0x3b0) returned 0 [0058.466] GetProcessHeap () returned 0x1130000 [0058.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.466] GetProcessHeap () returned 0x1130000 [0058.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.466] GetProcessHeap () returned 0x1130000 [0058.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.467] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 246 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.467] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.467] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175ab8 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.467] GetProcessHeap () returned 0x1130000 [0058.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.468] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.468] WriteFile (in: hFile=0x3b0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.468] CloseHandle (hObject=0x3b0) returned 0 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.468] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 247 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.468] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.468] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175ab8 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175ae0 [0058.468] GetProcessHeap () returned 0x1130000 [0058.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.469] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.469] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.469] CloseHandle (hObject=0x3c0) returned 0 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.469] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 248 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.469] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.469] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x11759a0 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.469] GetProcessHeap () returned 0x1130000 [0058.469] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175950 [0058.470] GetProcessHeap () returned 0x1130000 [0058.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.470] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.470] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.470] CloseHandle (hObject=0x3c0) returned 0 [0058.470] GetProcessHeap () returned 0x1130000 [0058.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.470] GetProcessHeap () returned 0x1130000 [0058.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.470] GetProcessHeap () returned 0x1130000 [0058.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.470] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 249 [0058.470] GetProcessHeap () returned 0x1130000 [0058.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.470] GetProcessHeap () returned 0x1130000 [0058.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.470] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.470] GetProcessHeap () returned 0x1130000 [0058.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.471] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.471] GetProcessHeap () returned 0x1130000 [0058.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.471] GetProcessHeap () returned 0x1130000 [0058.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.471] GetProcessHeap () returned 0x1130000 [0058.471] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175748 [0058.471] GetProcessHeap () returned 0x1130000 [0058.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.471] GetProcessHeap () returned 0x1130000 [0058.471] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x1175b08 [0058.471] GetProcessHeap () returned 0x1130000 [0058.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.471] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.471] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.471] CloseHandle (hObject=0x3c0) returned 0 [0058.471] GetProcessHeap () returned 0x1130000 [0058.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.471] GetProcessHeap () returned 0x1130000 [0058.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.472] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 250 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.472] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.472] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175720 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x1175928 [0058.472] GetProcessHeap () returned 0x1130000 [0058.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.473] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.473] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.473] CloseHandle (hObject=0x3c0) returned 0 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0058.473] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 251 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.473] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.473] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175b08 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175978 [0058.473] GetProcessHeap () returned 0x1130000 [0058.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.474] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.474] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.474] CloseHandle (hObject=0x3c0) returned 0 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.474] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 252 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.474] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.474] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x11756f8 [0058.474] GetProcessHeap () returned 0x1130000 [0058.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.475] GetProcessHeap () returned 0x1130000 [0058.475] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.475] GetProcessHeap () returned 0x1130000 [0058.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.475] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.475] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.475] CloseHandle (hObject=0x3c0) returned 0 [0058.475] GetProcessHeap () returned 0x1130000 [0058.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.475] GetProcessHeap () returned 0x1130000 [0058.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.475] GetProcessHeap () returned 0x1130000 [0058.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.475] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 253 [0058.475] GetProcessHeap () returned 0x1130000 [0058.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.475] GetProcessHeap () returned 0x1130000 [0058.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0058.475] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.476] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175b08 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175b30 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.476] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.476] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.476] CloseHandle (hObject=0x3c0) returned 0 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.476] GetProcessHeap () returned 0x1130000 [0058.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.477] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 254 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.477] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.477] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175a18 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175a40 [0058.477] GetProcessHeap () returned 0x1130000 [0058.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.478] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.478] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.478] CloseHandle (hObject=0x3c0) returned 0 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.478] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 255 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.478] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.478] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175770 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11758d8 [0058.478] GetProcessHeap () returned 0x1130000 [0058.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.479] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.479] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.479] CloseHandle (hObject=0x3c0) returned 0 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.479] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 256 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.479] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.479] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x11759a0 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.479] GetProcessHeap () returned 0x1130000 [0058.479] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.480] GetProcessHeap () returned 0x1130000 [0058.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.480] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.480] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.480] CloseHandle (hObject=0x3c0) returned 0 [0058.480] GetProcessHeap () returned 0x1130000 [0058.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.480] GetProcessHeap () returned 0x1130000 [0058.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.480] GetProcessHeap () returned 0x1130000 [0058.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.480] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 257 [0058.480] GetProcessHeap () returned 0x1130000 [0058.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.480] GetProcessHeap () returned 0x1130000 [0058.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.480] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.480] GetProcessHeap () returned 0x1130000 [0058.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.480] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.481] GetProcessHeap () returned 0x1130000 [0058.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.481] GetProcessHeap () returned 0x1130000 [0058.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.481] GetProcessHeap () returned 0x1130000 [0058.481] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a40 [0058.481] GetProcessHeap () returned 0x1130000 [0058.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.481] GetProcessHeap () returned 0x1130000 [0058.481] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175798 [0058.481] GetProcessHeap () returned 0x1130000 [0058.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.496] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.516] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.520] CloseHandle (hObject=0x3c0) returned 0 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.524] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 259 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.524] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.524] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b08 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ba8 [0058.524] GetProcessHeap () returned 0x1130000 [0058.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.525] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.525] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.525] CloseHandle (hObject=0x3c0) returned 0 [0058.525] GetProcessHeap () returned 0x1130000 [0058.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.525] GetProcessHeap () returned 0x1130000 [0058.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.525] GetProcessHeap () returned 0x1130000 [0058.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.525] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 260 [0058.525] GetProcessHeap () returned 0x1130000 [0058.525] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.525] GetProcessHeap () returned 0x1130000 [0058.525] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.525] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.525] GetProcessHeap () returned 0x1130000 [0058.526] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.526] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.526] GetProcessHeap () returned 0x1130000 [0058.526] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.526] GetProcessHeap () returned 0x1130000 [0058.526] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.526] GetProcessHeap () returned 0x1130000 [0058.526] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175ba8 [0058.526] GetProcessHeap () returned 0x1130000 [0058.526] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.526] GetProcessHeap () returned 0x1130000 [0058.526] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175860 [0058.526] GetProcessHeap () returned 0x1130000 [0058.526] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.526] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.526] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.526] CloseHandle (hObject=0x3c0) returned 0 [0058.526] GetProcessHeap () returned 0x1130000 [0058.527] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.527] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 261 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.527] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.527] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11756f8 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175900 [0058.527] GetProcessHeap () returned 0x1130000 [0058.527] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.528] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.528] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.528] CloseHandle (hObject=0x3c0) returned 0 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.528] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 262 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.528] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.528] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.528] GetProcessHeap () returned 0x1130000 [0058.528] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175a68 [0058.529] GetProcessHeap () returned 0x1130000 [0058.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.529] GetProcessHeap () returned 0x1130000 [0058.529] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11756f8 [0058.529] GetProcessHeap () returned 0x1130000 [0058.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.529] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.529] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.529] CloseHandle (hObject=0x3c0) returned 0 [0058.529] GetProcessHeap () returned 0x1130000 [0058.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.529] GetProcessHeap () returned 0x1130000 [0058.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.529] GetProcessHeap () returned 0x1130000 [0058.529] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.529] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 263 [0058.529] GetProcessHeap () returned 0x1130000 [0058.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.529] GetProcessHeap () returned 0x1130000 [0058.529] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.530] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.530] GetProcessHeap () returned 0x1130000 [0058.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.530] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.530] GetProcessHeap () returned 0x1130000 [0058.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.530] GetProcessHeap () returned 0x1130000 [0058.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.530] GetProcessHeap () returned 0x1130000 [0058.530] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c98, Size=0x20) returned 0x1175ae0 [0058.530] GetProcessHeap () returned 0x1130000 [0058.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.530] GetProcessHeap () returned 0x1130000 [0058.530] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0058.530] GetProcessHeap () returned 0x1130000 [0058.530] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.530] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.530] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.530] CloseHandle (hObject=0x3c0) returned 0 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.531] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 264 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.531] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.531] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175ae0 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x11756f8 [0058.531] GetProcessHeap () returned 0x1130000 [0058.531] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.532] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.532] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.532] CloseHandle (hObject=0x3c0) returned 0 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0058.532] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 265 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a90 [0058.532] SystemFunction036 (in: RandomBuffer=0x1175a90, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a90) returned 1 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.532] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175770 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175720 [0058.532] GetProcessHeap () returned 0x1130000 [0058.532] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.533] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.533] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.533] CloseHandle (hObject=0x3c0) returned 0 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.533] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 266 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0058.533] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.533] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.533] GetProcessHeap () returned 0x1130000 [0058.533] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x11759a0 [0058.534] GetProcessHeap () returned 0x1130000 [0058.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.534] GetProcessHeap () returned 0x1130000 [0058.534] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175888 [0058.534] GetProcessHeap () returned 0x1130000 [0058.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.534] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.534] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.534] CloseHandle (hObject=0x3c0) returned 0 [0058.534] GetProcessHeap () returned 0x1130000 [0058.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.534] GetProcessHeap () returned 0x1130000 [0058.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.534] GetProcessHeap () returned 0x1130000 [0058.534] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.534] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 267 [0058.534] GetProcessHeap () returned 0x1130000 [0058.534] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.534] GetProcessHeap () returned 0x1130000 [0058.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.535] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.535] GetProcessHeap () returned 0x1130000 [0058.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.535] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.535] GetProcessHeap () returned 0x1130000 [0058.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.535] GetProcessHeap () returned 0x1130000 [0058.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.535] GetProcessHeap () returned 0x1130000 [0058.535] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0058.535] GetProcessHeap () returned 0x1130000 [0058.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.535] GetProcessHeap () returned 0x1130000 [0058.535] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175a18 [0058.535] GetProcessHeap () returned 0x1130000 [0058.535] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.535] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.535] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.535] CloseHandle (hObject=0x3c0) returned 0 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.536] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 268 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.536] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.536] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11758b0 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175720 [0058.536] GetProcessHeap () returned 0x1130000 [0058.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.537] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.537] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.537] CloseHandle (hObject=0x3c0) returned 0 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.537] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 269 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.537] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.537] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bf8, Size=0x20) returned 0x1175ab8 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175928 [0058.537] GetProcessHeap () returned 0x1130000 [0058.537] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.538] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.538] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.538] CloseHandle (hObject=0x3c0) returned 0 [0058.538] GetProcessHeap () returned 0x1130000 [0058.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.538] GetProcessHeap () returned 0x1130000 [0058.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.538] GetProcessHeap () returned 0x1130000 [0058.538] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.538] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 270 [0058.538] GetProcessHeap () returned 0x1130000 [0058.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.538] GetProcessHeap () returned 0x1130000 [0058.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175978 [0058.538] SystemFunction036 (in: RandomBuffer=0x1175978, RandomBufferLength=0x20 | out: RandomBuffer=0x1175978) returned 1 [0058.538] GetProcessHeap () returned 0x1130000 [0058.538] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.538] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.538] GetProcessHeap () returned 0x1130000 [0058.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.539] GetProcessHeap () returned 0x1130000 [0058.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.539] GetProcessHeap () returned 0x1130000 [0058.539] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175720 [0058.539] GetProcessHeap () returned 0x1130000 [0058.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.539] GetProcessHeap () returned 0x1130000 [0058.539] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.539] GetProcessHeap () returned 0x1130000 [0058.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.539] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.539] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.539] CloseHandle (hObject=0x3c0) returned 0 [0058.539] GetProcessHeap () returned 0x1130000 [0058.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.539] GetProcessHeap () returned 0x1130000 [0058.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0058.539] GetProcessHeap () returned 0x1130000 [0058.539] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.540] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 271 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.540] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.540] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175ab8 [0058.540] GetProcessHeap () returned 0x1130000 [0058.540] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.540] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.541] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.541] CloseHandle (hObject=0x3c0) returned 0 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.541] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 272 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.541] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.541] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11759a0 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x11758d8 [0058.541] GetProcessHeap () returned 0x1130000 [0058.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.542] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.542] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.542] CloseHandle (hObject=0x3c0) returned 0 [0058.542] GetProcessHeap () returned 0x1130000 [0058.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.542] GetProcessHeap () returned 0x1130000 [0058.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.542] GetProcessHeap () returned 0x1130000 [0058.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.542] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 273 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.543] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.543] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11758b0 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175ae0 [0058.543] GetProcessHeap () returned 0x1130000 [0058.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.544] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.544] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.544] CloseHandle (hObject=0x3c0) returned 0 [0058.544] GetProcessHeap () returned 0x1130000 [0058.544] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.544] GetProcessHeap () returned 0x1130000 [0058.544] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.544] GetProcessHeap () returned 0x1130000 [0058.544] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.544] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 274 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.545] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.545] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b30 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175ae0 [0058.545] GetProcessHeap () returned 0x1130000 [0058.545] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.545] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.546] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.546] CloseHandle (hObject=0x3c0) returned 0 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.546] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 275 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.546] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.546] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175ae0 [0058.546] GetProcessHeap () returned 0x1130000 [0058.546] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.547] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.547] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.547] CloseHandle (hObject=0x3c0) returned 0 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.547] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 276 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.547] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.547] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175978 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.547] GetProcessHeap () returned 0x1130000 [0058.547] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11756f8 [0058.547] GetProcessHeap () returned 0x1130000 [0058.548] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.548] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.548] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.548] CloseHandle (hObject=0x3c0) returned 0 [0058.548] GetProcessHeap () returned 0x1130000 [0058.548] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.548] GetProcessHeap () returned 0x1130000 [0058.548] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.548] GetProcessHeap () returned 0x1130000 [0058.548] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0058.548] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 277 [0058.548] GetProcessHeap () returned 0x1130000 [0058.548] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.548] GetProcessHeap () returned 0x1130000 [0058.548] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.548] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.548] GetProcessHeap () returned 0x1130000 [0058.548] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.548] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.548] GetProcessHeap () returned 0x1130000 [0058.549] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.549] GetProcessHeap () returned 0x1130000 [0058.549] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.549] GetProcessHeap () returned 0x1130000 [0058.549] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175a18 [0058.549] GetProcessHeap () returned 0x1130000 [0058.549] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.549] GetProcessHeap () returned 0x1130000 [0058.549] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175748 [0058.549] GetProcessHeap () returned 0x1130000 [0058.549] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.549] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.549] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.549] CloseHandle (hObject=0x3c0) returned 0 [0058.549] GetProcessHeap () returned 0x1130000 [0058.549] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.549] GetProcessHeap () returned 0x1130000 [0058.549] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.549] GetProcessHeap () returned 0x1130000 [0058.549] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.549] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 278 [0058.549] GetProcessHeap () returned 0x1130000 [0058.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.550] GetProcessHeap () returned 0x1130000 [0058.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a90 [0058.550] SystemFunction036 (in: RandomBuffer=0x1175a90, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a90) returned 1 [0058.550] GetProcessHeap () returned 0x1130000 [0058.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.550] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.550] GetProcessHeap () returned 0x1130000 [0058.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.550] GetProcessHeap () returned 0x1130000 [0058.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.550] GetProcessHeap () returned 0x1130000 [0058.550] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175720 [0058.550] GetProcessHeap () returned 0x1130000 [0058.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.550] GetProcessHeap () returned 0x1130000 [0058.550] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.550] GetProcessHeap () returned 0x1130000 [0058.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.550] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.550] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.551] CloseHandle (hObject=0x3c0) returned 0 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.551] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 279 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.551] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.551] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175860 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11758b0 [0058.551] GetProcessHeap () returned 0x1130000 [0058.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.552] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.552] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.552] CloseHandle (hObject=0x3c0) returned 0 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.552] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 280 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.552] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.552] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x11758b0 [0058.552] GetProcessHeap () returned 0x1130000 [0058.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.553] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.553] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.553] CloseHandle (hObject=0x3c0) returned 0 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.553] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 281 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.553] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.553] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.553] GetProcessHeap () returned 0x1130000 [0058.553] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0058.554] GetProcessHeap () returned 0x1130000 [0058.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.554] GetProcessHeap () returned 0x1130000 [0058.554] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11759c8 [0058.554] GetProcessHeap () returned 0x1130000 [0058.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.554] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.554] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.554] CloseHandle (hObject=0x3c0) returned 0 [0058.554] GetProcessHeap () returned 0x1130000 [0058.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.554] GetProcessHeap () returned 0x1130000 [0058.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.554] GetProcessHeap () returned 0x1130000 [0058.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.554] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 282 [0058.554] GetProcessHeap () returned 0x1130000 [0058.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.554] GetProcessHeap () returned 0x1130000 [0058.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.555] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.555] GetProcessHeap () returned 0x1130000 [0058.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.555] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.555] GetProcessHeap () returned 0x1130000 [0058.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.555] GetProcessHeap () returned 0x1130000 [0058.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.555] GetProcessHeap () returned 0x1130000 [0058.555] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0058.555] GetProcessHeap () returned 0x1130000 [0058.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.555] GetProcessHeap () returned 0x1130000 [0058.555] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175748 [0058.555] GetProcessHeap () returned 0x1130000 [0058.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.555] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.555] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.555] CloseHandle (hObject=0x3c0) returned 0 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.556] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 283 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.556] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.556] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175798 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0058.556] GetProcessHeap () returned 0x1130000 [0058.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.557] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.557] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.557] CloseHandle (hObject=0x3c0) returned 0 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.557] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 284 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.557] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.557] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x11759a0 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0058.557] GetProcessHeap () returned 0x1130000 [0058.557] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.558] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.558] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.558] CloseHandle (hObject=0x3c0) returned 0 [0058.558] GetProcessHeap () returned 0x1130000 [0058.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.558] GetProcessHeap () returned 0x1130000 [0058.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.558] GetProcessHeap () returned 0x1130000 [0058.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.558] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 285 [0058.558] GetProcessHeap () returned 0x1130000 [0058.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.558] GetProcessHeap () returned 0x1130000 [0058.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11757c0 [0058.558] SystemFunction036 (in: RandomBuffer=0x11757c0, RandomBufferLength=0x20 | out: RandomBuffer=0x11757c0) returned 1 [0058.558] GetProcessHeap () returned 0x1130000 [0058.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.558] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.558] GetProcessHeap () returned 0x1130000 [0058.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.558] GetProcessHeap () returned 0x1130000 [0058.558] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.559] GetProcessHeap () returned 0x1130000 [0058.559] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.559] GetProcessHeap () returned 0x1130000 [0058.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.559] GetProcessHeap () returned 0x1130000 [0058.559] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175860 [0058.559] GetProcessHeap () returned 0x1130000 [0058.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.559] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.559] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.566] CloseHandle (hObject=0x3c0) returned 0 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.566] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 287 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.566] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.566] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.566] GetProcessHeap () returned 0x1130000 [0058.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.567] GetProcessHeap () returned 0x1130000 [0058.567] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175888 [0058.567] GetProcessHeap () returned 0x1130000 [0058.567] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.567] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.567] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.567] CloseHandle (hObject=0x3c0) returned 0 [0058.567] GetProcessHeap () returned 0x1130000 [0058.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.567] GetProcessHeap () returned 0x1130000 [0058.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.567] GetProcessHeap () returned 0x1130000 [0058.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.567] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 288 [0058.567] GetProcessHeap () returned 0x1130000 [0058.567] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.567] GetProcessHeap () returned 0x1130000 [0058.567] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.568] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.568] GetProcessHeap () returned 0x1130000 [0058.568] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.568] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.568] GetProcessHeap () returned 0x1130000 [0058.568] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.568] GetProcessHeap () returned 0x1130000 [0058.568] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.568] GetProcessHeap () returned 0x1130000 [0058.568] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11758b0 [0058.568] GetProcessHeap () returned 0x1130000 [0058.568] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.568] GetProcessHeap () returned 0x1130000 [0058.568] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175770 [0058.568] GetProcessHeap () returned 0x1130000 [0058.568] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.568] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.568] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.568] CloseHandle (hObject=0x3c0) returned 0 [0058.568] GetProcessHeap () returned 0x1130000 [0058.568] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.569] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 289 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.569] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.569] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175b58 [0058.569] GetProcessHeap () returned 0x1130000 [0058.569] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.570] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.570] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.570] CloseHandle (hObject=0x3c0) returned 0 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.570] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 290 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0058.570] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.570] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175720 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175978 [0058.570] GetProcessHeap () returned 0x1130000 [0058.570] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.571] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.571] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.571] CloseHandle (hObject=0x3c0) returned 0 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.571] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 291 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.571] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.571] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.571] GetProcessHeap () returned 0x1130000 [0058.571] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.572] GetProcessHeap () returned 0x1130000 [0058.572] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175720 [0058.572] GetProcessHeap () returned 0x1130000 [0058.572] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.572] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.572] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.572] CloseHandle (hObject=0x3c0) returned 0 [0058.572] GetProcessHeap () returned 0x1130000 [0058.572] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.572] GetProcessHeap () returned 0x1130000 [0058.572] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.572] GetProcessHeap () returned 0x1130000 [0058.572] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.572] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 292 [0058.572] GetProcessHeap () returned 0x1130000 [0058.572] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.572] GetProcessHeap () returned 0x1130000 [0058.572] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0058.572] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0058.573] GetProcessHeap () returned 0x1130000 [0058.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.573] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.573] GetProcessHeap () returned 0x1130000 [0058.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.573] GetProcessHeap () returned 0x1130000 [0058.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.573] GetProcessHeap () returned 0x1130000 [0058.573] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x11757c0 [0058.573] GetProcessHeap () returned 0x1130000 [0058.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.573] GetProcessHeap () returned 0x1130000 [0058.573] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175860 [0058.573] GetProcessHeap () returned 0x1130000 [0058.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.573] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.573] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.573] CloseHandle (hObject=0x3c0) returned 0 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.574] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 293 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.574] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.574] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11758b0 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x11756f8 [0058.574] GetProcessHeap () returned 0x1130000 [0058.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.575] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.575] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.575] CloseHandle (hObject=0x3c0) returned 0 [0058.575] GetProcessHeap () returned 0x1130000 [0058.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.575] GetProcessHeap () returned 0x1130000 [0058.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.575] GetProcessHeap () returned 0x1130000 [0058.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.575] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 294 [0058.575] GetProcessHeap () returned 0x1130000 [0058.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.575] GetProcessHeap () returned 0x1130000 [0058.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.575] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.575] GetProcessHeap () returned 0x1130000 [0058.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.575] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.575] GetProcessHeap () returned 0x1130000 [0058.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.576] GetProcessHeap () returned 0x1130000 [0058.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.576] GetProcessHeap () returned 0x1130000 [0058.576] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x11759a0 [0058.576] GetProcessHeap () returned 0x1130000 [0058.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.576] GetProcessHeap () returned 0x1130000 [0058.576] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x11756f8 [0058.576] GetProcessHeap () returned 0x1130000 [0058.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.576] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.576] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.576] CloseHandle (hObject=0x3c0) returned 0 [0058.576] GetProcessHeap () returned 0x1130000 [0058.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.576] GetProcessHeap () returned 0x1130000 [0058.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.576] GetProcessHeap () returned 0x1130000 [0058.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.576] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 295 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.577] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.577] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175928 [0058.577] GetProcessHeap () returned 0x1130000 [0058.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.577] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.577] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.578] CloseHandle (hObject=0x3c0) returned 0 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.578] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 296 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.578] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.578] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11759a0 [0058.578] GetProcessHeap () returned 0x1130000 [0058.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.579] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.579] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.579] CloseHandle (hObject=0x3c0) returned 0 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.579] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 297 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.579] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.579] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175860 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x11759c8 [0058.579] GetProcessHeap () returned 0x1130000 [0058.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.580] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.580] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.580] CloseHandle (hObject=0x3c0) returned 0 [0058.580] GetProcessHeap () returned 0x1130000 [0058.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.580] GetProcessHeap () returned 0x1130000 [0058.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.580] GetProcessHeap () returned 0x1130000 [0058.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.580] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 298 [0058.580] GetProcessHeap () returned 0x1130000 [0058.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.580] GetProcessHeap () returned 0x1130000 [0058.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.580] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.580] GetProcessHeap () returned 0x1130000 [0058.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.580] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.580] GetProcessHeap () returned 0x1130000 [0058.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.580] GetProcessHeap () returned 0x1130000 [0058.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.580] GetProcessHeap () returned 0x1130000 [0058.581] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x11758d8 [0058.581] GetProcessHeap () returned 0x1130000 [0058.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.581] GetProcessHeap () returned 0x1130000 [0058.581] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175900 [0058.581] GetProcessHeap () returned 0x1130000 [0058.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.581] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.581] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.581] CloseHandle (hObject=0x3c0) returned 0 [0058.581] GetProcessHeap () returned 0x1130000 [0058.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.581] GetProcessHeap () returned 0x1130000 [0058.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.581] GetProcessHeap () returned 0x1130000 [0058.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.581] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 299 [0058.581] GetProcessHeap () returned 0x1130000 [0058.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.582] GetProcessHeap () returned 0x1130000 [0058.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0058.582] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0058.582] GetProcessHeap () returned 0x1130000 [0058.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.582] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.582] GetProcessHeap () returned 0x1130000 [0058.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.582] GetProcessHeap () returned 0x1130000 [0058.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.582] GetProcessHeap () returned 0x1130000 [0058.582] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0058.582] GetProcessHeap () returned 0x1130000 [0058.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.582] GetProcessHeap () returned 0x1130000 [0058.582] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x1175a18 [0058.582] GetProcessHeap () returned 0x1130000 [0058.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.582] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.582] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.583] CloseHandle (hObject=0x3c0) returned 0 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.583] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 300 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.583] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.583] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175950 [0058.583] GetProcessHeap () returned 0x1130000 [0058.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.584] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.584] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.584] CloseHandle (hObject=0x3c0) returned 0 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.584] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 301 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.584] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.584] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.584] GetProcessHeap () returned 0x1130000 [0058.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.585] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.585] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.585] CloseHandle (hObject=0x3c0) returned 0 [0058.585] GetProcessHeap () returned 0x1130000 [0058.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.585] GetProcessHeap () returned 0x1130000 [0058.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.585] GetProcessHeap () returned 0x1130000 [0058.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.585] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 302 [0058.585] GetProcessHeap () returned 0x1130000 [0058.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.585] GetProcessHeap () returned 0x1130000 [0058.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175978 [0058.585] SystemFunction036 (in: RandomBuffer=0x1175978, RandomBufferLength=0x20 | out: RandomBuffer=0x1175978) returned 1 [0058.585] GetProcessHeap () returned 0x1130000 [0058.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.585] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.585] GetProcessHeap () returned 0x1130000 [0058.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.585] GetProcessHeap () returned 0x1130000 [0058.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.585] GetProcessHeap () returned 0x1130000 [0058.586] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0058.586] GetProcessHeap () returned 0x1130000 [0058.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.586] GetProcessHeap () returned 0x1130000 [0058.586] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175860 [0058.586] GetProcessHeap () returned 0x1130000 [0058.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.586] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.586] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.586] CloseHandle (hObject=0x3c0) returned 0 [0058.586] GetProcessHeap () returned 0x1130000 [0058.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.586] GetProcessHeap () returned 0x1130000 [0058.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0058.586] GetProcessHeap () returned 0x1130000 [0058.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.587] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 303 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.587] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.587] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175798 [0058.587] GetProcessHeap () returned 0x1130000 [0058.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.588] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.588] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.588] CloseHandle (hObject=0x3a8) returned 0 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.588] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 304 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.588] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.588] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ab8 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11757c0 [0058.588] GetProcessHeap () returned 0x1130000 [0058.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.589] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.589] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.589] CloseHandle (hObject=0x3a8) returned 0 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.589] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 305 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.589] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.589] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175950 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175b58 [0058.589] GetProcessHeap () returned 0x1130000 [0058.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.590] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.590] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.590] CloseHandle (hObject=0x3c0) returned 0 [0058.590] GetProcessHeap () returned 0x1130000 [0058.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.590] GetProcessHeap () returned 0x1130000 [0058.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.590] GetProcessHeap () returned 0x1130000 [0058.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.590] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 306 [0058.590] GetProcessHeap () returned 0x1130000 [0058.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.590] GetProcessHeap () returned 0x1130000 [0058.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0058.590] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0058.590] GetProcessHeap () returned 0x1130000 [0058.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.591] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.591] GetProcessHeap () returned 0x1130000 [0058.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.591] GetProcessHeap () returned 0x1130000 [0058.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.591] GetProcessHeap () returned 0x1130000 [0058.591] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175b08 [0058.591] GetProcessHeap () returned 0x1130000 [0058.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.591] GetProcessHeap () returned 0x1130000 [0058.591] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175a40 [0058.591] GetProcessHeap () returned 0x1130000 [0058.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.592] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.592] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.592] CloseHandle (hObject=0x3c0) returned 0 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.592] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 307 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.592] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.592] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175928 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.592] GetProcessHeap () returned 0x1130000 [0058.592] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175888 [0058.593] GetProcessHeap () returned 0x1130000 [0058.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.593] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.593] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.593] CloseHandle (hObject=0x3c0) returned 0 [0058.593] GetProcessHeap () returned 0x1130000 [0058.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.593] GetProcessHeap () returned 0x1130000 [0058.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.593] GetProcessHeap () returned 0x1130000 [0058.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.593] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 308 [0058.593] GetProcessHeap () returned 0x1130000 [0058.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.593] GetProcessHeap () returned 0x1130000 [0058.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0058.593] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0058.593] GetProcessHeap () returned 0x1130000 [0058.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.593] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.594] GetProcessHeap () returned 0x1130000 [0058.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.594] GetProcessHeap () returned 0x1130000 [0058.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.594] GetProcessHeap () returned 0x1130000 [0058.594] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175978 [0058.594] GetProcessHeap () returned 0x1130000 [0058.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.594] GetProcessHeap () returned 0x1130000 [0058.594] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175b08 [0058.594] GetProcessHeap () returned 0x1130000 [0058.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.594] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.594] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.594] CloseHandle (hObject=0x3c0) returned 0 [0058.594] GetProcessHeap () returned 0x1130000 [0058.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.594] GetProcessHeap () returned 0x1130000 [0058.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0058.594] GetProcessHeap () returned 0x1130000 [0058.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.595] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 309 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0058.595] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.595] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175ab8 [0058.595] GetProcessHeap () returned 0x1130000 [0058.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.596] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.596] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.596] CloseHandle (hObject=0x3c0) returned 0 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.596] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 310 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.596] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.596] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175b30 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175ab8 [0058.596] GetProcessHeap () returned 0x1130000 [0058.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.597] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.597] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.597] CloseHandle (hObject=0x3c0) returned 0 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.597] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 311 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0058.597] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.597] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175a18 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x11759a0 [0058.597] GetProcessHeap () returned 0x1130000 [0058.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.598] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.598] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.598] CloseHandle (hObject=0x3c0) returned 0 [0058.598] GetProcessHeap () returned 0x1130000 [0058.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.598] GetProcessHeap () returned 0x1130000 [0058.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0058.598] GetProcessHeap () returned 0x1130000 [0058.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.598] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 312 [0058.598] GetProcessHeap () returned 0x1130000 [0058.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.598] GetProcessHeap () returned 0x1130000 [0058.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.598] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.598] GetProcessHeap () returned 0x1130000 [0058.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.598] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.599] GetProcessHeap () returned 0x1130000 [0058.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.599] GetProcessHeap () returned 0x1130000 [0058.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.599] GetProcessHeap () returned 0x1130000 [0058.599] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x11758d8 [0058.599] GetProcessHeap () returned 0x1130000 [0058.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.599] GetProcessHeap () returned 0x1130000 [0058.599] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175748 [0058.599] GetProcessHeap () returned 0x1130000 [0058.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.599] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.599] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.599] CloseHandle (hObject=0x3c0) returned 0 [0058.599] GetProcessHeap () returned 0x1130000 [0058.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.599] GetProcessHeap () returned 0x1130000 [0058.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.599] GetProcessHeap () returned 0x1130000 [0058.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.600] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 313 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.600] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.600] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175720 [0058.600] GetProcessHeap () returned 0x1130000 [0058.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.600] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.601] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.601] CloseHandle (hObject=0x3c0) returned 0 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.601] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 314 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.601] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.601] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175798 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175b08 [0058.601] GetProcessHeap () returned 0x1130000 [0058.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.602] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.602] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.602] CloseHandle (hObject=0x3c0) returned 0 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.602] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 315 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.602] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.602] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175ba8 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x11756f8 [0058.602] GetProcessHeap () returned 0x1130000 [0058.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.603] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.603] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.603] CloseHandle (hObject=0x3c0) returned 0 [0058.603] GetProcessHeap () returned 0x1130000 [0058.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.603] GetProcessHeap () returned 0x1130000 [0058.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.603] GetProcessHeap () returned 0x1130000 [0058.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.603] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 316 [0058.603] GetProcessHeap () returned 0x1130000 [0058.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.603] GetProcessHeap () returned 0x1130000 [0058.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.603] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.603] GetProcessHeap () returned 0x1130000 [0058.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.603] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.603] GetProcessHeap () returned 0x1130000 [0058.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bf8, Size=0x20) returned 0x1175860 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175b08 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.604] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.604] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.604] CloseHandle (hObject=0x3c0) returned 0 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.604] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 317 [0058.604] GetProcessHeap () returned 0x1130000 [0058.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.605] GetProcessHeap () returned 0x1130000 [0058.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759c8 [0058.605] SystemFunction036 (in: RandomBuffer=0x11759c8, RandomBufferLength=0x20 | out: RandomBuffer=0x11759c8) returned 1 [0058.605] GetProcessHeap () returned 0x1130000 [0058.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.605] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.605] GetProcessHeap () returned 0x1130000 [0058.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.605] GetProcessHeap () returned 0x1130000 [0058.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.605] GetProcessHeap () returned 0x1130000 [0058.605] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x11757c0 [0058.605] GetProcessHeap () returned 0x1130000 [0058.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.605] GetProcessHeap () returned 0x1130000 [0058.605] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x11759a0 [0058.605] GetProcessHeap () returned 0x1130000 [0058.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.605] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.605] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.605] CloseHandle (hObject=0x3c0) returned 0 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.606] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 318 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.606] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.606] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175b30 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175a18 [0058.606] GetProcessHeap () returned 0x1130000 [0058.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.613] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.613] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.613] CloseHandle (hObject=0x3c0) returned 0 [0058.613] GetProcessHeap () returned 0x1130000 [0058.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.613] GetProcessHeap () returned 0x1130000 [0058.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.613] GetProcessHeap () returned 0x1130000 [0058.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.613] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 320 [0058.613] GetProcessHeap () returned 0x1130000 [0058.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.613] GetProcessHeap () returned 0x1130000 [0058.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.613] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.613] GetProcessHeap () returned 0x1130000 [0058.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.614] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.614] GetProcessHeap () returned 0x1130000 [0058.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.614] GetProcessHeap () returned 0x1130000 [0058.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.614] GetProcessHeap () returned 0x1130000 [0058.614] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.614] GetProcessHeap () returned 0x1130000 [0058.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.614] GetProcessHeap () returned 0x1130000 [0058.614] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0058.614] GetProcessHeap () returned 0x1130000 [0058.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.614] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.614] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.614] CloseHandle (hObject=0x3c0) returned 0 [0058.614] GetProcessHeap () returned 0x1130000 [0058.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.614] GetProcessHeap () returned 0x1130000 [0058.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.615] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 321 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759c8 [0058.615] SystemFunction036 (in: RandomBuffer=0x11759c8, RandomBufferLength=0x20 | out: RandomBuffer=0x11759c8) returned 1 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.615] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175ab8 [0058.615] GetProcessHeap () returned 0x1130000 [0058.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.616] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.616] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.616] CloseHandle (hObject=0x3c0) returned 0 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.616] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 322 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a90 [0058.616] SystemFunction036 (in: RandomBuffer=0x1175a90, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a90) returned 1 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.616] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175770 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175720 [0058.616] GetProcessHeap () returned 0x1130000 [0058.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.617] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.617] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.617] CloseHandle (hObject=0x3c0) returned 0 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.617] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 323 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.617] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.617] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175770 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.617] GetProcessHeap () returned 0x1130000 [0058.617] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175798 [0058.618] GetProcessHeap () returned 0x1130000 [0058.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.618] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.618] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.618] CloseHandle (hObject=0x3c0) returned 0 [0058.618] GetProcessHeap () returned 0x1130000 [0058.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.618] GetProcessHeap () returned 0x1130000 [0058.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.618] GetProcessHeap () returned 0x1130000 [0058.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.618] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 324 [0058.618] GetProcessHeap () returned 0x1130000 [0058.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.618] GetProcessHeap () returned 0x1130000 [0058.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.618] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.618] GetProcessHeap () returned 0x1130000 [0058.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.618] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175a18 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x11758d8 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.619] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.619] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.619] CloseHandle (hObject=0x3c0) returned 0 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.619] GetProcessHeap () returned 0x1130000 [0058.619] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.619] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 325 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.620] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.620] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175720 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.620] GetProcessHeap () returned 0x1130000 [0058.620] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.620] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.620] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.620] CloseHandle (hObject=0x3c0) returned 0 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.621] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 326 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756d0 [0058.621] SystemFunction036 (in: RandomBuffer=0x11756d0, RandomBufferLength=0x20 | out: RandomBuffer=0x11756d0) returned 1 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.621] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175928 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175860 [0058.621] GetProcessHeap () returned 0x1130000 [0058.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.622] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.622] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.622] CloseHandle (hObject=0x3c0) returned 0 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.622] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 327 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.622] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.622] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.622] GetProcessHeap () returned 0x1130000 [0058.622] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b68, Size=0x20) returned 0x1175ab8 [0058.622] GetProcessHeap () returned 0x1130000 [0058.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.623] GetProcessHeap () returned 0x1130000 [0058.623] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175ae0 [0058.623] GetProcessHeap () returned 0x1130000 [0058.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.623] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.623] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.623] CloseHandle (hObject=0x3c0) returned 0 [0058.623] GetProcessHeap () returned 0x1130000 [0058.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.623] GetProcessHeap () returned 0x1130000 [0058.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.623] GetProcessHeap () returned 0x1130000 [0058.623] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.623] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 328 [0058.623] GetProcessHeap () returned 0x1130000 [0058.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.623] GetProcessHeap () returned 0x1130000 [0058.623] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.624] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.624] GetProcessHeap () returned 0x1130000 [0058.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.624] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.624] GetProcessHeap () returned 0x1130000 [0058.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.624] GetProcessHeap () returned 0x1130000 [0058.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.624] GetProcessHeap () returned 0x1130000 [0058.624] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175a90 [0058.624] GetProcessHeap () returned 0x1130000 [0058.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.624] GetProcessHeap () returned 0x1130000 [0058.624] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11758b0 [0058.624] GetProcessHeap () returned 0x1130000 [0058.624] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.624] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.624] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.624] CloseHandle (hObject=0x3c0) returned 0 [0058.624] GetProcessHeap () returned 0x1130000 [0058.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.625] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 329 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.625] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.625] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175860 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175950 [0058.625] GetProcessHeap () returned 0x1130000 [0058.625] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.626] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.626] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.626] CloseHandle (hObject=0x3c0) returned 0 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.626] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 330 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.626] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.626] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ae0 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175a18 [0058.626] GetProcessHeap () returned 0x1130000 [0058.626] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.627] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.627] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.627] CloseHandle (hObject=0x3c0) returned 0 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.627] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 331 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759c8 [0058.627] SystemFunction036 (in: RandomBuffer=0x11759c8, RandomBufferLength=0x20 | out: RandomBuffer=0x11759c8) returned 1 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.627] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.627] GetProcessHeap () returned 0x1130000 [0058.627] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175ae0 [0058.628] GetProcessHeap () returned 0x1130000 [0058.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.628] GetProcessHeap () returned 0x1130000 [0058.628] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.628] GetProcessHeap () returned 0x1130000 [0058.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.628] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.628] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.628] CloseHandle (hObject=0x3c0) returned 0 [0058.628] GetProcessHeap () returned 0x1130000 [0058.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.628] GetProcessHeap () returned 0x1130000 [0058.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0058.628] GetProcessHeap () returned 0x1130000 [0058.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.628] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 332 [0058.628] GetProcessHeap () returned 0x1130000 [0058.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.629] GetProcessHeap () returned 0x1130000 [0058.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.629] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.629] GetProcessHeap () returned 0x1130000 [0058.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.629] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.629] GetProcessHeap () returned 0x1130000 [0058.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.629] GetProcessHeap () returned 0x1130000 [0058.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.629] GetProcessHeap () returned 0x1130000 [0058.629] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c98, Size=0x20) returned 0x1175ae0 [0058.629] GetProcessHeap () returned 0x1130000 [0058.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.629] GetProcessHeap () returned 0x1130000 [0058.629] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x11759a0 [0058.629] GetProcessHeap () returned 0x1130000 [0058.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.629] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.629] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.630] CloseHandle (hObject=0x3c0) returned 0 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.630] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 333 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.630] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.630] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11756f8 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175720 [0058.630] GetProcessHeap () returned 0x1130000 [0058.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.631] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.631] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.631] CloseHandle (hObject=0x3c0) returned 0 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.631] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 334 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.631] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.631] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175748 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175b08 [0058.631] GetProcessHeap () returned 0x1130000 [0058.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.632] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.632] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.632] CloseHandle (hObject=0x3c0) returned 0 [0058.632] GetProcessHeap () returned 0x1130000 [0058.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.632] GetProcessHeap () returned 0x1130000 [0058.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.632] GetProcessHeap () returned 0x1130000 [0058.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.632] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 335 [0058.632] GetProcessHeap () returned 0x1130000 [0058.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.632] GetProcessHeap () returned 0x1130000 [0058.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.632] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.632] GetProcessHeap () returned 0x1130000 [0058.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.632] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.632] GetProcessHeap () returned 0x1130000 [0058.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.632] GetProcessHeap () returned 0x1130000 [0058.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.633] GetProcessHeap () returned 0x1130000 [0058.633] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.633] GetProcessHeap () returned 0x1130000 [0058.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.633] GetProcessHeap () returned 0x1130000 [0058.633] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x11759a0 [0058.633] GetProcessHeap () returned 0x1130000 [0058.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.633] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.633] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.633] CloseHandle (hObject=0x3c0) returned 0 [0058.633] GetProcessHeap () returned 0x1130000 [0058.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.633] GetProcessHeap () returned 0x1130000 [0058.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.633] GetProcessHeap () returned 0x1130000 [0058.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.633] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 336 [0058.633] GetProcessHeap () returned 0x1130000 [0058.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.633] GetProcessHeap () returned 0x1130000 [0058.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.634] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.634] GetProcessHeap () returned 0x1130000 [0058.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.634] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.634] GetProcessHeap () returned 0x1130000 [0058.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.634] GetProcessHeap () returned 0x1130000 [0058.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.634] GetProcessHeap () returned 0x1130000 [0058.634] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.634] GetProcessHeap () returned 0x1130000 [0058.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.634] GetProcessHeap () returned 0x1130000 [0058.634] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11758b0 [0058.634] GetProcessHeap () returned 0x1130000 [0058.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.634] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.634] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.634] CloseHandle (hObject=0x3c0) returned 0 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.635] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 337 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.635] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.635] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x11759c8 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175b30 [0058.635] GetProcessHeap () returned 0x1130000 [0058.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.636] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.636] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.636] CloseHandle (hObject=0x3c0) returned 0 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.636] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 338 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0058.636] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.636] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bf8, Size=0x20) returned 0x1175860 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x11756d0 [0058.636] GetProcessHeap () returned 0x1130000 [0058.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.637] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.637] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.637] CloseHandle (hObject=0x3c0) returned 0 [0058.637] GetProcessHeap () returned 0x1130000 [0058.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.637] GetProcessHeap () returned 0x1130000 [0058.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.637] GetProcessHeap () returned 0x1130000 [0058.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.637] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 339 [0058.637] GetProcessHeap () returned 0x1130000 [0058.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.637] GetProcessHeap () returned 0x1130000 [0058.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.637] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.637] GetProcessHeap () returned 0x1130000 [0058.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.637] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.638] GetProcessHeap () returned 0x1130000 [0058.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.638] GetProcessHeap () returned 0x1130000 [0058.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.638] GetProcessHeap () returned 0x1130000 [0058.638] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175748 [0058.638] GetProcessHeap () returned 0x1130000 [0058.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.638] GetProcessHeap () returned 0x1130000 [0058.638] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175720 [0058.638] GetProcessHeap () returned 0x1130000 [0058.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.638] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.638] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.638] CloseHandle (hObject=0x3c0) returned 0 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.639] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 340 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.639] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.639] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a68 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175a90 [0058.639] GetProcessHeap () returned 0x1130000 [0058.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.640] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.640] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.640] CloseHandle (hObject=0x3c0) returned 0 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.640] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 341 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.640] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.640] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x11759a0 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0058.640] GetProcessHeap () returned 0x1130000 [0058.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.641] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.641] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.641] CloseHandle (hObject=0x3c0) returned 0 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.641] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 342 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11757c0 [0058.641] SystemFunction036 (in: RandomBuffer=0x11757c0, RandomBufferLength=0x20 | out: RandomBuffer=0x11757c0) returned 1 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.641] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.641] GetProcessHeap () returned 0x1130000 [0058.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.642] GetProcessHeap () returned 0x1130000 [0058.642] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175860 [0058.642] GetProcessHeap () returned 0x1130000 [0058.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.642] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.642] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.642] CloseHandle (hObject=0x3c0) returned 0 [0058.642] GetProcessHeap () returned 0x1130000 [0058.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.642] GetProcessHeap () returned 0x1130000 [0058.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0058.642] GetProcessHeap () returned 0x1130000 [0058.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.642] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 343 [0058.642] GetProcessHeap () returned 0x1130000 [0058.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.642] GetProcessHeap () returned 0x1130000 [0058.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.642] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.642] GetProcessHeap () returned 0x1130000 [0058.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.643] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175ab8 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175860 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.643] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.643] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.643] CloseHandle (hObject=0x3c0) returned 0 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.643] GetProcessHeap () returned 0x1130000 [0058.643] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.644] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 344 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.644] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.644] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175798 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175860 [0058.644] GetProcessHeap () returned 0x1130000 [0058.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.644] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.645] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.645] CloseHandle (hObject=0x3c0) returned 0 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.645] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 345 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.645] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.645] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.645] GetProcessHeap () returned 0x1130000 [0058.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.646] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.646] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.646] CloseHandle (hObject=0x3c0) returned 0 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.646] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 346 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.646] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.646] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11759a0 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175720 [0058.646] GetProcessHeap () returned 0x1130000 [0058.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.647] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.647] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.647] CloseHandle (hObject=0x3c0) returned 0 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.647] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 347 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0058.647] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.647] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.647] GetProcessHeap () returned 0x1130000 [0058.647] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x11759c8 [0058.647] GetProcessHeap () returned 0x1130000 [0058.648] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.648] GetProcessHeap () returned 0x1130000 [0058.648] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.648] GetProcessHeap () returned 0x1130000 [0058.648] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.648] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.648] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.648] CloseHandle (hObject=0x3c0) returned 0 [0058.648] GetProcessHeap () returned 0x1130000 [0058.648] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.648] GetProcessHeap () returned 0x1130000 [0058.648] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0058.648] GetProcessHeap () returned 0x1130000 [0058.648] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.648] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 348 [0058.648] GetProcessHeap () returned 0x1130000 [0058.648] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.648] GetProcessHeap () returned 0x1130000 [0058.648] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11757c0 [0058.648] SystemFunction036 (in: RandomBuffer=0x11757c0, RandomBufferLength=0x20 | out: RandomBuffer=0x11757c0) returned 1 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.649] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175900 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175860 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.649] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.649] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.649] CloseHandle (hObject=0x3c0) returned 0 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.649] GetProcessHeap () returned 0x1130000 [0058.649] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.650] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 349 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.650] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.650] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175a18 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11758b0 [0058.650] GetProcessHeap () returned 0x1130000 [0058.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.651] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.651] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.651] CloseHandle (hObject=0x3c0) returned 0 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.651] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 350 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.651] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.651] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175950 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x11759a0 [0058.651] GetProcessHeap () returned 0x1130000 [0058.651] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.652] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.652] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.652] CloseHandle (hObject=0x3c0) returned 0 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.652] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 351 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.652] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.652] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175888 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.652] GetProcessHeap () returned 0x1130000 [0058.652] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11758b0 [0058.652] GetProcessHeap () returned 0x1130000 [0058.653] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.653] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.665] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.665] CloseHandle (hObject=0x3c0) returned 0 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.665] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 353 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.665] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.665] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0058.665] GetProcessHeap () returned 0x1130000 [0058.665] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.666] GetProcessHeap () returned 0x1130000 [0058.666] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175a18 [0058.666] GetProcessHeap () returned 0x1130000 [0058.666] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.666] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.666] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.666] CloseHandle (hObject=0x3c0) returned 0 [0058.666] GetProcessHeap () returned 0x1130000 [0058.666] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.666] GetProcessHeap () returned 0x1130000 [0058.666] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.666] GetProcessHeap () returned 0x1130000 [0058.666] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.666] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 354 [0058.666] GetProcessHeap () returned 0x1130000 [0058.666] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.666] GetProcessHeap () returned 0x1130000 [0058.666] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.666] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.667] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x11759a0 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x11756d0 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.667] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.667] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.667] CloseHandle (hObject=0x3c0) returned 0 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.667] GetProcessHeap () returned 0x1130000 [0058.667] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.667] GetProcessHeap () returned 0x1130000 [0058.668] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.668] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 355 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.668] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.668] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175798 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175748 [0058.668] GetProcessHeap () returned 0x1130000 [0058.668] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.668] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.669] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.669] CloseHandle (hObject=0x3c0) returned 0 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.669] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 356 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0058.669] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.669] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175860 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.669] GetProcessHeap () returned 0x1130000 [0058.669] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175a40 [0058.669] GetProcessHeap () returned 0x1130000 [0058.670] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.670] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.670] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.670] CloseHandle (hObject=0x3c0) returned 0 [0058.670] GetProcessHeap () returned 0x1130000 [0058.670] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.670] GetProcessHeap () returned 0x1130000 [0058.670] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.670] GetProcessHeap () returned 0x1130000 [0058.670] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.670] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 357 [0058.670] GetProcessHeap () returned 0x1130000 [0058.670] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.670] GetProcessHeap () returned 0x1130000 [0058.670] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.670] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.670] GetProcessHeap () returned 0x1130000 [0058.670] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.671] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.671] GetProcessHeap () returned 0x1130000 [0058.671] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.671] GetProcessHeap () returned 0x1130000 [0058.671] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.671] GetProcessHeap () returned 0x1130000 [0058.671] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175720 [0058.671] GetProcessHeap () returned 0x1130000 [0058.671] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.671] GetProcessHeap () returned 0x1130000 [0058.671] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0058.671] GetProcessHeap () returned 0x1130000 [0058.671] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.671] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.671] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.671] CloseHandle (hObject=0x3c0) returned 0 [0058.671] GetProcessHeap () returned 0x1130000 [0058.671] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.671] GetProcessHeap () returned 0x1130000 [0058.671] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.672] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 358 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.672] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.672] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175928 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175b30 [0058.672] GetProcessHeap () returned 0x1130000 [0058.672] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.673] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.673] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.673] CloseHandle (hObject=0x3c0) returned 0 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.673] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 359 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.673] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.673] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175ab8 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11756f8 [0058.673] GetProcessHeap () returned 0x1130000 [0058.673] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.674] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.674] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.674] CloseHandle (hObject=0x3c0) returned 0 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.674] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 360 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.674] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.674] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.674] GetProcessHeap () returned 0x1130000 [0058.674] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x11758b0 [0058.674] GetProcessHeap () returned 0x1130000 [0058.675] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.675] GetProcessHeap () returned 0x1130000 [0058.675] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175798 [0058.675] GetProcessHeap () returned 0x1130000 [0058.675] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.675] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.675] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.675] CloseHandle (hObject=0x3c0) returned 0 [0058.675] GetProcessHeap () returned 0x1130000 [0058.675] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.675] GetProcessHeap () returned 0x1130000 [0058.675] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.675] GetProcessHeap () returned 0x1130000 [0058.675] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.675] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 361 [0058.675] GetProcessHeap () returned 0x1130000 [0058.675] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.675] GetProcessHeap () returned 0x1130000 [0058.675] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.676] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.676] GetProcessHeap () returned 0x1130000 [0058.676] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.676] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.676] GetProcessHeap () returned 0x1130000 [0058.676] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.676] GetProcessHeap () returned 0x1130000 [0058.676] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.676] GetProcessHeap () returned 0x1130000 [0058.676] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175a18 [0058.676] GetProcessHeap () returned 0x1130000 [0058.676] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.676] GetProcessHeap () returned 0x1130000 [0058.676] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.676] GetProcessHeap () returned 0x1130000 [0058.676] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.676] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.676] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.676] CloseHandle (hObject=0x3c0) returned 0 [0058.676] GetProcessHeap () returned 0x1130000 [0058.676] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.676] GetProcessHeap () returned 0x1130000 [0058.677] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.677] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 362 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.677] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.677] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11758d8 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175720 [0058.677] GetProcessHeap () returned 0x1130000 [0058.677] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.678] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.678] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.678] CloseHandle (hObject=0x3c0) returned 0 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.678] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 363 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.678] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0058.678] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175b30 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175978 [0058.678] GetProcessHeap () returned 0x1130000 [0058.678] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.679] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.679] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.679] CloseHandle (hObject=0x3c0) returned 0 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.679] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 364 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.679] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.679] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175888 [0058.679] GetProcessHeap () returned 0x1130000 [0058.679] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.679] GetProcessHeap () returned 0x1130000 [0058.680] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175978 [0058.680] GetProcessHeap () returned 0x1130000 [0058.680] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.680] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.680] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.680] CloseHandle (hObject=0x3c0) returned 0 [0058.680] GetProcessHeap () returned 0x1130000 [0058.680] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.680] GetProcessHeap () returned 0x1130000 [0058.680] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.680] GetProcessHeap () returned 0x1130000 [0058.680] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.680] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 365 [0058.680] GetProcessHeap () returned 0x1130000 [0058.680] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.680] GetProcessHeap () returned 0x1130000 [0058.680] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.680] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.680] GetProcessHeap () returned 0x1130000 [0058.680] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.680] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175888 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175a68 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.681] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.681] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.681] CloseHandle (hObject=0x3c0) returned 0 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.681] GetProcessHeap () returned 0x1130000 [0058.681] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.681] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 366 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.682] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.682] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175ba8 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x11756f8 [0058.682] GetProcessHeap () returned 0x1130000 [0058.682] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.683] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.683] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.683] CloseHandle (hObject=0x3c0) returned 0 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.683] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 367 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.683] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.683] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bf8, Size=0x20) returned 0x1175860 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175b08 [0058.683] GetProcessHeap () returned 0x1130000 [0058.683] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.684] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.684] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.684] CloseHandle (hObject=0x3c0) returned 0 [0058.684] GetProcessHeap () returned 0x1130000 [0058.684] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.684] GetProcessHeap () returned 0x1130000 [0058.684] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.684] GetProcessHeap () returned 0x1130000 [0058.684] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.684] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 368 [0058.684] GetProcessHeap () returned 0x1130000 [0058.684] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.684] GetProcessHeap () returned 0x1130000 [0058.684] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.684] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.693] GetProcessHeap () returned 0x1130000 [0058.693] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.693] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.693] GetProcessHeap () returned 0x1130000 [0058.693] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.693] GetProcessHeap () returned 0x1130000 [0058.693] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.693] GetProcessHeap () returned 0x1130000 [0058.693] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175900 [0058.693] GetProcessHeap () returned 0x1130000 [0058.693] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.693] GetProcessHeap () returned 0x1130000 [0058.693] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175a18 [0058.693] GetProcessHeap () returned 0x1130000 [0058.693] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.694] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.694] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.694] CloseHandle (hObject=0x3c0) returned 0 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.694] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 369 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.694] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.694] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11756f8 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175770 [0058.694] GetProcessHeap () returned 0x1130000 [0058.694] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.695] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.695] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.695] CloseHandle (hObject=0x3c0) returned 0 [0058.695] GetProcessHeap () returned 0x1130000 [0058.695] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.695] GetProcessHeap () returned 0x1130000 [0058.695] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.695] GetProcessHeap () returned 0x1130000 [0058.695] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.695] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 370 [0058.695] GetProcessHeap () returned 0x1130000 [0058.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.695] GetProcessHeap () returned 0x1130000 [0058.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.695] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.695] GetProcessHeap () returned 0x1130000 [0058.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.695] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.695] GetProcessHeap () returned 0x1130000 [0058.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.695] GetProcessHeap () returned 0x1130000 [0058.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.696] GetProcessHeap () returned 0x1130000 [0058.696] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175888 [0058.696] GetProcessHeap () returned 0x1130000 [0058.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.696] GetProcessHeap () returned 0x1130000 [0058.696] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x11759a0 [0058.696] GetProcessHeap () returned 0x1130000 [0058.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.696] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.696] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.696] CloseHandle (hObject=0x3c0) returned 0 [0058.696] GetProcessHeap () returned 0x1130000 [0058.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.696] GetProcessHeap () returned 0x1130000 [0058.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.696] GetProcessHeap () returned 0x1130000 [0058.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.696] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 371 [0058.696] GetProcessHeap () returned 0x1130000 [0058.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.696] GetProcessHeap () returned 0x1130000 [0058.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.697] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.697] GetProcessHeap () returned 0x1130000 [0058.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.697] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.697] GetProcessHeap () returned 0x1130000 [0058.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.697] GetProcessHeap () returned 0x1130000 [0058.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.697] GetProcessHeap () returned 0x1130000 [0058.697] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x11756f8 [0058.697] GetProcessHeap () returned 0x1130000 [0058.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.697] GetProcessHeap () returned 0x1130000 [0058.697] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175a40 [0058.697] GetProcessHeap () returned 0x1130000 [0058.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.697] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.697] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.697] CloseHandle (hObject=0x3c0) returned 0 [0058.697] GetProcessHeap () returned 0x1130000 [0058.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.698] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 372 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.698] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.698] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175720 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175b08 [0058.698] GetProcessHeap () returned 0x1130000 [0058.698] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.699] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.699] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.699] CloseHandle (hObject=0x3c0) returned 0 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.699] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 373 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0058.699] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.699] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175770 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175ba8 [0058.699] GetProcessHeap () returned 0x1130000 [0058.699] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.700] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.700] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.700] CloseHandle (hObject=0x3c0) returned 0 [0058.700] GetProcessHeap () returned 0x1130000 [0058.700] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.700] GetProcessHeap () returned 0x1130000 [0058.700] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0058.700] GetProcessHeap () returned 0x1130000 [0058.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.701] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 374 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.701] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0058.701] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11759c8 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175a90 [0058.701] GetProcessHeap () returned 0x1130000 [0058.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.702] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.702] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.702] CloseHandle (hObject=0x3c0) returned 0 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.702] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 375 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.702] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.702] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175ab8 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175ae0 [0058.702] GetProcessHeap () returned 0x1130000 [0058.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.703] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.703] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.703] CloseHandle (hObject=0x3c0) returned 0 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.703] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 376 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.703] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.703] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x11756f8 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0058.703] GetProcessHeap () returned 0x1130000 [0058.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.704] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.704] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.704] CloseHandle (hObject=0x3c0) returned 0 [0058.704] GetProcessHeap () returned 0x1130000 [0058.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.704] GetProcessHeap () returned 0x1130000 [0058.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.704] GetProcessHeap () returned 0x1130000 [0058.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.704] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 377 [0058.704] GetProcessHeap () returned 0x1130000 [0058.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.704] GetProcessHeap () returned 0x1130000 [0058.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.704] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.704] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.704] GetProcessHeap () returned 0x1130000 [0058.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.704] GetProcessHeap () returned 0x1130000 [0058.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.704] GetProcessHeap () returned 0x1130000 [0058.704] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11759c8 [0058.705] GetProcessHeap () returned 0x1130000 [0058.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.705] GetProcessHeap () returned 0x1130000 [0058.705] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0058.705] GetProcessHeap () returned 0x1130000 [0058.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.705] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.705] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.705] CloseHandle (hObject=0x3c0) returned 0 [0058.705] GetProcessHeap () returned 0x1130000 [0058.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.705] GetProcessHeap () returned 0x1130000 [0058.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.705] GetProcessHeap () returned 0x1130000 [0058.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.705] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 378 [0058.705] GetProcessHeap () returned 0x1130000 [0058.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.705] GetProcessHeap () returned 0x1130000 [0058.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.705] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.706] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.706] GetProcessHeap () returned 0x1130000 [0058.706] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.706] GetProcessHeap () returned 0x1130000 [0058.706] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.706] GetProcessHeap () returned 0x1130000 [0058.706] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ab8 [0058.706] GetProcessHeap () returned 0x1130000 [0058.706] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.706] GetProcessHeap () returned 0x1130000 [0058.706] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175ae0 [0058.706] GetProcessHeap () returned 0x1130000 [0058.706] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.706] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.706] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.706] CloseHandle (hObject=0x3c0) returned 0 [0058.706] GetProcessHeap () returned 0x1130000 [0058.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.707] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 379 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.707] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.707] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175928 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x11759c8 [0058.707] GetProcessHeap () returned 0x1130000 [0058.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.709] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.709] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.709] CloseHandle (hObject=0x3c0) returned 0 [0058.709] GetProcessHeap () returned 0x1130000 [0058.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.709] GetProcessHeap () returned 0x1130000 [0058.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.709] GetProcessHeap () returned 0x1130000 [0058.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.709] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 380 [0058.709] GetProcessHeap () returned 0x1130000 [0058.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.709] GetProcessHeap () returned 0x1130000 [0058.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.709] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.709] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.709] GetProcessHeap () returned 0x1130000 [0058.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.709] GetProcessHeap () returned 0x1130000 [0058.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.709] GetProcessHeap () returned 0x1130000 [0058.710] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175a18 [0058.710] GetProcessHeap () returned 0x1130000 [0058.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.710] GetProcessHeap () returned 0x1130000 [0058.710] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175900 [0058.710] GetProcessHeap () returned 0x1130000 [0058.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.710] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.710] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.710] CloseHandle (hObject=0x3c0) returned 0 [0058.710] GetProcessHeap () returned 0x1130000 [0058.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.710] GetProcessHeap () returned 0x1130000 [0058.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.710] GetProcessHeap () returned 0x1130000 [0058.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.710] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 381 [0058.711] GetProcessHeap () returned 0x1130000 [0058.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.711] GetProcessHeap () returned 0x1130000 [0058.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.711] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.711] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.711] GetProcessHeap () returned 0x1130000 [0058.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.711] GetProcessHeap () returned 0x1130000 [0058.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.711] GetProcessHeap () returned 0x1130000 [0058.711] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175a68 [0058.711] GetProcessHeap () returned 0x1130000 [0058.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.711] GetProcessHeap () returned 0x1130000 [0058.711] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175928 [0058.711] GetProcessHeap () returned 0x1130000 [0058.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.711] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.712] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.712] CloseHandle (hObject=0x3c0) returned 0 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.712] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 382 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0058.712] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0058.712] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x11759a0 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175928 [0058.712] GetProcessHeap () returned 0x1130000 [0058.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.713] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.713] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.713] CloseHandle (hObject=0x3c0) returned 0 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.713] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 383 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175978 [0058.713] SystemFunction036 (in: RandomBuffer=0x1175978, RandomBufferLength=0x20 | out: RandomBuffer=0x1175978) returned 1 [0058.713] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175720 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.713] GetProcessHeap () returned 0x1130000 [0058.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.714] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.714] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.714] CloseHandle (hObject=0x3c0) returned 0 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.714] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 384 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.714] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.714] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.714] GetProcessHeap () returned 0x1130000 [0058.714] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175ab8 [0058.714] GetProcessHeap () returned 0x1130000 [0058.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.715] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.715] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.715] CloseHandle (hObject=0x3c0) returned 0 [0058.715] GetProcessHeap () returned 0x1130000 [0058.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.715] GetProcessHeap () returned 0x1130000 [0058.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.715] GetProcessHeap () returned 0x1130000 [0058.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.715] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 385 [0058.715] GetProcessHeap () returned 0x1130000 [0058.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.715] GetProcessHeap () returned 0x1130000 [0058.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.715] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.715] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.715] GetProcessHeap () returned 0x1130000 [0058.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.803] GetProcessHeap () returned 0x1130000 [0058.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.803] GetProcessHeap () returned 0x1130000 [0058.803] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11759a0 [0058.804] GetProcessHeap () returned 0x1130000 [0058.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.804] GetProcessHeap () returned 0x1130000 [0058.804] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x11758d8 [0058.804] GetProcessHeap () returned 0x1130000 [0058.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.804] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.804] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.804] CloseHandle (hObject=0x3c0) returned 0 [0058.804] GetProcessHeap () returned 0x1130000 [0058.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.804] GetProcessHeap () returned 0x1130000 [0058.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.804] GetProcessHeap () returned 0x1130000 [0058.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.804] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 387 [0058.804] GetProcessHeap () returned 0x1130000 [0058.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.805] GetProcessHeap () returned 0x1130000 [0058.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.805] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.805] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.805] GetProcessHeap () returned 0x1130000 [0058.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.805] GetProcessHeap () returned 0x1130000 [0058.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.805] GetProcessHeap () returned 0x1130000 [0058.805] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11758b0 [0058.805] GetProcessHeap () returned 0x1130000 [0058.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.805] GetProcessHeap () returned 0x1130000 [0058.805] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175ae0 [0058.805] GetProcessHeap () returned 0x1130000 [0058.805] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.805] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.805] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.805] CloseHandle (hObject=0x3c0) returned 0 [0058.805] GetProcessHeap () returned 0x1130000 [0058.805] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.805] GetProcessHeap () returned 0x1130000 [0058.806] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.806] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 388 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0058.806] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0058.806] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b30 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175ae0 [0058.806] GetProcessHeap () returned 0x1130000 [0058.806] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.807] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.807] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.807] CloseHandle (hObject=0x3c0) returned 0 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.807] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 389 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.807] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.807] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175ae0 [0058.807] GetProcessHeap () returned 0x1130000 [0058.807] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.808] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.808] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.808] CloseHandle (hObject=0x3c0) returned 0 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.808] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 390 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.808] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.808] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175978 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11756f8 [0058.808] GetProcessHeap () returned 0x1130000 [0058.808] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.809] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.809] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.809] CloseHandle (hObject=0x3c0) returned 0 [0058.809] GetProcessHeap () returned 0x1130000 [0058.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.809] GetProcessHeap () returned 0x1130000 [0058.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.809] GetProcessHeap () returned 0x1130000 [0058.809] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0058.809] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 391 [0058.809] GetProcessHeap () returned 0x1130000 [0058.809] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.809] GetProcessHeap () returned 0x1130000 [0058.810] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.810] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.810] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.810] GetProcessHeap () returned 0x1130000 [0058.810] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.810] GetProcessHeap () returned 0x1130000 [0058.810] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.810] GetProcessHeap () returned 0x1130000 [0058.810] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175a18 [0058.810] GetProcessHeap () returned 0x1130000 [0058.810] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.810] GetProcessHeap () returned 0x1130000 [0058.810] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175748 [0058.810] GetProcessHeap () returned 0x1130000 [0058.810] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.810] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.810] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.810] CloseHandle (hObject=0x3c0) returned 0 [0058.811] GetProcessHeap () returned 0x1130000 [0058.811] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.811] GetProcessHeap () returned 0x1130000 [0058.811] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.811] GetProcessHeap () returned 0x1130000 [0058.811] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.811] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 392 [0058.811] GetProcessHeap () returned 0x1130000 [0058.811] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.812] GetProcessHeap () returned 0x1130000 [0058.812] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a90 [0058.812] SystemFunction036 (in: RandomBuffer=0x1175a90, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a90) returned 1 [0058.812] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.812] GetProcessHeap () returned 0x1130000 [0058.812] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.812] GetProcessHeap () returned 0x1130000 [0058.812] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.812] GetProcessHeap () returned 0x1130000 [0058.812] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175720 [0058.813] GetProcessHeap () returned 0x1130000 [0058.813] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.813] GetProcessHeap () returned 0x1130000 [0058.813] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.813] GetProcessHeap () returned 0x1130000 [0058.813] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.813] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.813] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.813] CloseHandle (hObject=0x3c0) returned 0 [0058.813] GetProcessHeap () returned 0x1130000 [0058.813] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.813] GetProcessHeap () returned 0x1130000 [0058.813] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0058.813] GetProcessHeap () returned 0x1130000 [0058.813] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.813] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 393 [0058.814] GetProcessHeap () returned 0x1130000 [0058.814] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.814] GetProcessHeap () returned 0x1130000 [0058.814] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.814] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.814] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.814] GetProcessHeap () returned 0x1130000 [0058.814] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.814] GetProcessHeap () returned 0x1130000 [0058.814] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.814] GetProcessHeap () returned 0x1130000 [0058.814] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175860 [0058.814] GetProcessHeap () returned 0x1130000 [0058.814] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.814] GetProcessHeap () returned 0x1130000 [0058.814] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11758b0 [0058.814] GetProcessHeap () returned 0x1130000 [0058.814] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.815] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.815] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.815] CloseHandle (hObject=0x3c0) returned 0 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.815] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 394 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.815] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.815] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x11758b0 [0058.815] GetProcessHeap () returned 0x1130000 [0058.815] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.816] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.816] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.816] CloseHandle (hObject=0x3c0) returned 0 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.816] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 395 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.816] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.816] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11759c8 [0058.816] GetProcessHeap () returned 0x1130000 [0058.816] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.817] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.817] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.817] CloseHandle (hObject=0x3c0) returned 0 [0058.817] GetProcessHeap () returned 0x1130000 [0058.817] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.817] GetProcessHeap () returned 0x1130000 [0058.817] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.817] GetProcessHeap () returned 0x1130000 [0058.817] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.817] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 396 [0058.817] GetProcessHeap () returned 0x1130000 [0058.817] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.817] GetProcessHeap () returned 0x1130000 [0058.817] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.817] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.817] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.817] GetProcessHeap () returned 0x1130000 [0058.817] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.818] GetProcessHeap () returned 0x1130000 [0058.818] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.818] GetProcessHeap () returned 0x1130000 [0058.818] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0058.818] GetProcessHeap () returned 0x1130000 [0058.818] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.818] GetProcessHeap () returned 0x1130000 [0058.818] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175748 [0058.818] GetProcessHeap () returned 0x1130000 [0058.818] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0058.818] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.818] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.818] CloseHandle (hObject=0x3c0) returned 0 [0058.818] GetProcessHeap () returned 0x1130000 [0058.818] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.818] GetProcessHeap () returned 0x1130000 [0058.818] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.818] GetProcessHeap () returned 0x1130000 [0058.818] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.819] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 397 [0058.819] GetProcessHeap () returned 0x1130000 [0058.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.819] GetProcessHeap () returned 0x1130000 [0058.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.819] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.819] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.819] GetProcessHeap () returned 0x1130000 [0058.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.819] GetProcessHeap () returned 0x1130000 [0058.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.819] GetProcessHeap () returned 0x1130000 [0058.819] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175798 [0058.819] GetProcessHeap () returned 0x1130000 [0058.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.819] GetProcessHeap () returned 0x1130000 [0058.819] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0058.819] GetProcessHeap () returned 0x1130000 [0058.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.820] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.820] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.820] CloseHandle (hObject=0x3c0) returned 0 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.820] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 398 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.820] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.820] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x11759a0 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0058.820] GetProcessHeap () returned 0x1130000 [0058.820] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.821] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.821] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.821] CloseHandle (hObject=0x3c0) returned 0 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.821] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 399 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11757c0 [0058.821] SystemFunction036 (in: RandomBuffer=0x11757c0, RandomBufferLength=0x20 | out: RandomBuffer=0x11757c0) returned 1 [0058.821] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175860 [0058.821] GetProcessHeap () returned 0x1130000 [0058.821] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.822] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.822] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.822] CloseHandle (hObject=0x3c0) returned 0 [0058.822] GetProcessHeap () returned 0x1130000 [0058.822] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.822] GetProcessHeap () returned 0x1130000 [0058.822] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0058.822] GetProcessHeap () returned 0x1130000 [0058.822] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.822] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 400 [0058.822] GetProcessHeap () returned 0x1130000 [0058.822] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.822] GetProcessHeap () returned 0x1130000 [0058.822] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0058.822] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0058.822] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.822] GetProcessHeap () returned 0x1130000 [0058.822] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.822] GetProcessHeap () returned 0x1130000 [0058.823] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.823] GetProcessHeap () returned 0x1130000 [0058.823] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.823] GetProcessHeap () returned 0x1130000 [0058.823] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.823] GetProcessHeap () returned 0x1130000 [0058.823] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175888 [0058.823] GetProcessHeap () returned 0x1130000 [0058.823] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.823] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.823] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.823] CloseHandle (hObject=0x3c0) returned 0 [0058.823] GetProcessHeap () returned 0x1130000 [0058.823] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.823] GetProcessHeap () returned 0x1130000 [0058.823] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.823] GetProcessHeap () returned 0x1130000 [0058.823] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.824] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 401 [0058.824] GetProcessHeap () returned 0x1130000 [0058.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.824] GetProcessHeap () returned 0x1130000 [0058.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.824] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.824] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.824] GetProcessHeap () returned 0x1130000 [0058.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.824] GetProcessHeap () returned 0x1130000 [0058.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.824] GetProcessHeap () returned 0x1130000 [0058.824] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11758b0 [0058.824] GetProcessHeap () returned 0x1130000 [0058.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.824] GetProcessHeap () returned 0x1130000 [0058.824] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175770 [0058.824] GetProcessHeap () returned 0x1130000 [0058.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.824] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.825] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.825] CloseHandle (hObject=0x3c0) returned 0 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.825] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 402 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.825] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.825] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.825] GetProcessHeap () returned 0x1130000 [0058.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.825] GetProcessHeap () returned 0x1130000 [0058.826] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175b58 [0058.826] GetProcessHeap () returned 0x1130000 [0058.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.826] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.826] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.826] CloseHandle (hObject=0x3c0) returned 0 [0058.826] GetProcessHeap () returned 0x1130000 [0058.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.826] GetProcessHeap () returned 0x1130000 [0058.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.826] GetProcessHeap () returned 0x1130000 [0058.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.826] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 403 [0058.826] GetProcessHeap () returned 0x1130000 [0058.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.826] GetProcessHeap () returned 0x1130000 [0058.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0058.827] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0058.827] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.827] GetProcessHeap () returned 0x1130000 [0058.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.827] GetProcessHeap () returned 0x1130000 [0058.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.827] GetProcessHeap () returned 0x1130000 [0058.827] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175720 [0058.827] GetProcessHeap () returned 0x1130000 [0058.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.827] GetProcessHeap () returned 0x1130000 [0058.827] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175978 [0058.827] GetProcessHeap () returned 0x1130000 [0058.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.827] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.827] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.827] CloseHandle (hObject=0x3c0) returned 0 [0058.827] GetProcessHeap () returned 0x1130000 [0058.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.828] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 404 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.828] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.828] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175720 [0058.828] GetProcessHeap () returned 0x1130000 [0058.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.829] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.829] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.829] CloseHandle (hObject=0x3c0) returned 0 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.829] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 405 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0058.829] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0058.829] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x11757c0 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175860 [0058.829] GetProcessHeap () returned 0x1130000 [0058.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.830] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.830] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.830] CloseHandle (hObject=0x3c0) returned 0 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.830] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 406 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0058.830] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0058.830] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11758b0 [0058.830] GetProcessHeap () returned 0x1130000 [0058.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.830] GetProcessHeap () returned 0x1130000 [0058.831] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x11756f8 [0058.831] GetProcessHeap () returned 0x1130000 [0058.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.831] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.831] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.831] CloseHandle (hObject=0x3c0) returned 0 [0058.831] GetProcessHeap () returned 0x1130000 [0058.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.831] GetProcessHeap () returned 0x1130000 [0058.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.831] GetProcessHeap () returned 0x1130000 [0058.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.831] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 407 [0058.831] GetProcessHeap () returned 0x1130000 [0058.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.831] GetProcessHeap () returned 0x1130000 [0058.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.832] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.832] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.832] GetProcessHeap () returned 0x1130000 [0058.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.832] GetProcessHeap () returned 0x1130000 [0058.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.832] GetProcessHeap () returned 0x1130000 [0058.832] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x11759a0 [0058.832] GetProcessHeap () returned 0x1130000 [0058.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.832] GetProcessHeap () returned 0x1130000 [0058.832] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x11756f8 [0058.832] GetProcessHeap () returned 0x1130000 [0058.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.832] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.832] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.832] CloseHandle (hObject=0x3c0) returned 0 [0058.832] GetProcessHeap () returned 0x1130000 [0058.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.833] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 408 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.833] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.833] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175928 [0058.833] GetProcessHeap () returned 0x1130000 [0058.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.834] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.834] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.834] CloseHandle (hObject=0x3c0) returned 0 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.834] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 409 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.834] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.834] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11759a0 [0058.834] GetProcessHeap () returned 0x1130000 [0058.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.835] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.835] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.835] CloseHandle (hObject=0x3c0) returned 0 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.835] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 410 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.835] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.835] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175860 [0058.835] GetProcessHeap () returned 0x1130000 [0058.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.835] GetProcessHeap () returned 0x1130000 [0058.836] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x11759c8 [0058.836] GetProcessHeap () returned 0x1130000 [0058.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.836] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.836] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.836] CloseHandle (hObject=0x3c0) returned 0 [0058.836] GetProcessHeap () returned 0x1130000 [0058.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.836] GetProcessHeap () returned 0x1130000 [0058.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.836] GetProcessHeap () returned 0x1130000 [0058.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.836] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 411 [0058.836] GetProcessHeap () returned 0x1130000 [0058.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.836] GetProcessHeap () returned 0x1130000 [0058.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.836] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.837] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.837] GetProcessHeap () returned 0x1130000 [0058.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.837] GetProcessHeap () returned 0x1130000 [0058.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.837] GetProcessHeap () returned 0x1130000 [0058.837] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175748 [0058.837] GetProcessHeap () returned 0x1130000 [0058.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.837] GetProcessHeap () returned 0x1130000 [0058.837] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175a18 [0058.837] GetProcessHeap () returned 0x1130000 [0058.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.837] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.837] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.837] CloseHandle (hObject=0x3c0) returned 0 [0058.837] GetProcessHeap () returned 0x1130000 [0058.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.837] GetProcessHeap () returned 0x1130000 [0058.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.838] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 412 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.838] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.838] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175a40 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175978 [0058.838] GetProcessHeap () returned 0x1130000 [0058.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.839] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.839] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.839] CloseHandle (hObject=0x3c0) returned 0 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.839] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 413 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0058.839] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0058.839] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a40 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175a18 [0058.839] GetProcessHeap () returned 0x1130000 [0058.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.840] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.840] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.840] CloseHandle (hObject=0x3c0) returned 0 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.840] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 414 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175720 [0058.840] SystemFunction036 (in: RandomBuffer=0x1175720, RandomBufferLength=0x20 | out: RandomBuffer=0x1175720) returned 1 [0058.840] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175860 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.840] GetProcessHeap () returned 0x1130000 [0058.840] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0058.858] GetProcessHeap () returned 0x1130000 [0058.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.859] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.859] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.859] CloseHandle (hObject=0x3c0) returned 0 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.859] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 416 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.859] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.859] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b30 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0058.859] GetProcessHeap () returned 0x1130000 [0058.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.860] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.860] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.860] CloseHandle (hObject=0x3c0) returned 0 [0058.860] GetProcessHeap () returned 0x1130000 [0058.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.860] GetProcessHeap () returned 0x1130000 [0058.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.860] GetProcessHeap () returned 0x1130000 [0058.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.860] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 417 [0058.860] GetProcessHeap () returned 0x1130000 [0058.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.860] GetProcessHeap () returned 0x1130000 [0058.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.860] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.860] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.860] GetProcessHeap () returned 0x1130000 [0058.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.860] GetProcessHeap () returned 0x1130000 [0058.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.861] GetProcessHeap () returned 0x1130000 [0058.861] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175ab8 [0058.861] GetProcessHeap () returned 0x1130000 [0058.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.861] GetProcessHeap () returned 0x1130000 [0058.861] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.861] GetProcessHeap () returned 0x1130000 [0058.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.861] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.861] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.861] CloseHandle (hObject=0x3c0) returned 0 [0058.861] GetProcessHeap () returned 0x1130000 [0058.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.861] GetProcessHeap () returned 0x1130000 [0058.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.861] GetProcessHeap () returned 0x1130000 [0058.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.861] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 418 [0058.861] GetProcessHeap () returned 0x1130000 [0058.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.862] GetProcessHeap () returned 0x1130000 [0058.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.862] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.862] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.862] GetProcessHeap () returned 0x1130000 [0058.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.862] GetProcessHeap () returned 0x1130000 [0058.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.862] GetProcessHeap () returned 0x1130000 [0058.862] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175ab8 [0058.862] GetProcessHeap () returned 0x1130000 [0058.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.862] GetProcessHeap () returned 0x1130000 [0058.862] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175ae0 [0058.862] GetProcessHeap () returned 0x1130000 [0058.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.862] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.862] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.862] CloseHandle (hObject=0x3c0) returned 0 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.863] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 419 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.863] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.863] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x11759a0 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175950 [0058.863] GetProcessHeap () returned 0x1130000 [0058.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.864] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.864] WriteFile (in: hFile=0x3a8, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.864] CloseHandle (hObject=0x3a8) returned 0 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.864] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 420 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.864] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.864] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175748 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x1175b08 [0058.864] GetProcessHeap () returned 0x1130000 [0058.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.865] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.865] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.865] CloseHandle (hObject=0x3a8) returned 0 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.865] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 421 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.865] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.865] ReadFile (in: hFile=0x3a8, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175720 [0058.865] GetProcessHeap () returned 0x1130000 [0058.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.865] GetProcessHeap () returned 0x1130000 [0058.866] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x1175928 [0058.866] GetProcessHeap () returned 0x1130000 [0058.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.866] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.866] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.866] CloseHandle (hObject=0x3a8) returned 0 [0058.866] GetProcessHeap () returned 0x1130000 [0058.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.866] GetProcessHeap () returned 0x1130000 [0058.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.866] GetProcessHeap () returned 0x1130000 [0058.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0058.866] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 422 [0058.866] GetProcessHeap () returned 0x1130000 [0058.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.866] GetProcessHeap () returned 0x1130000 [0058.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.867] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.867] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.867] GetProcessHeap () returned 0x1130000 [0058.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.867] GetProcessHeap () returned 0x1130000 [0058.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.867] GetProcessHeap () returned 0x1130000 [0058.867] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175b08 [0058.867] GetProcessHeap () returned 0x1130000 [0058.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.867] GetProcessHeap () returned 0x1130000 [0058.867] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175978 [0058.867] GetProcessHeap () returned 0x1130000 [0058.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.867] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.867] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.867] CloseHandle (hObject=0x3c0) returned 0 [0058.867] GetProcessHeap () returned 0x1130000 [0058.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.868] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 423 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0058.868] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0058.868] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x11756f8 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.868] GetProcessHeap () returned 0x1130000 [0058.868] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.869] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.869] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.869] CloseHandle (hObject=0x3c0) returned 0 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.869] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 424 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0058.869] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0058.869] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175b08 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175b30 [0058.869] GetProcessHeap () returned 0x1130000 [0058.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.870] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.870] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.870] CloseHandle (hObject=0x3c0) returned 0 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.870] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 425 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.870] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.870] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175a18 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.870] GetProcessHeap () returned 0x1130000 [0058.870] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175a40 [0058.870] GetProcessHeap () returned 0x1130000 [0058.871] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.871] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.871] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.871] CloseHandle (hObject=0x3c0) returned 0 [0058.871] GetProcessHeap () returned 0x1130000 [0058.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.871] GetProcessHeap () returned 0x1130000 [0058.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.871] GetProcessHeap () returned 0x1130000 [0058.871] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.871] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 426 [0058.873] GetProcessHeap () returned 0x1130000 [0058.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.873] GetProcessHeap () returned 0x1130000 [0058.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.873] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.873] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.873] GetProcessHeap () returned 0x1130000 [0058.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.873] GetProcessHeap () returned 0x1130000 [0058.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.873] GetProcessHeap () returned 0x1130000 [0058.873] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175770 [0058.873] GetProcessHeap () returned 0x1130000 [0058.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.873] GetProcessHeap () returned 0x1130000 [0058.873] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11758d8 [0058.873] GetProcessHeap () returned 0x1130000 [0058.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.874] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.874] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.874] CloseHandle (hObject=0x3c0) returned 0 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.874] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 427 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.874] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.874] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x11759a0 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0058.874] GetProcessHeap () returned 0x1130000 [0058.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.875] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.875] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.875] CloseHandle (hObject=0x3c0) returned 0 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.875] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 428 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0058.875] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0058.875] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a40 [0058.875] GetProcessHeap () returned 0x1130000 [0058.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.875] GetProcessHeap () returned 0x1130000 [0058.876] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175798 [0058.876] GetProcessHeap () returned 0x1130000 [0058.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.876] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.876] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.876] CloseHandle (hObject=0x3c0) returned 0 [0058.876] GetProcessHeap () returned 0x1130000 [0058.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.876] GetProcessHeap () returned 0x1130000 [0058.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.876] GetProcessHeap () returned 0x1130000 [0058.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.876] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 429 [0058.876] GetProcessHeap () returned 0x1130000 [0058.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.876] GetProcessHeap () returned 0x1130000 [0058.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0058.876] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0058.876] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.877] GetProcessHeap () returned 0x1130000 [0058.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.877] GetProcessHeap () returned 0x1130000 [0058.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.877] GetProcessHeap () returned 0x1130000 [0058.877] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b08 [0058.877] GetProcessHeap () returned 0x1130000 [0058.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.877] GetProcessHeap () returned 0x1130000 [0058.877] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ba8 [0058.877] GetProcessHeap () returned 0x1130000 [0058.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.877] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.877] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.877] CloseHandle (hObject=0x3c0) returned 0 [0058.877] GetProcessHeap () returned 0x1130000 [0058.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.877] GetProcessHeap () returned 0x1130000 [0058.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.877] GetProcessHeap () returned 0x1130000 [0058.878] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.878] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 430 [0058.878] GetProcessHeap () returned 0x1130000 [0058.878] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.878] GetProcessHeap () returned 0x1130000 [0058.878] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.878] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.878] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.878] GetProcessHeap () returned 0x1130000 [0058.878] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.878] GetProcessHeap () returned 0x1130000 [0058.878] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.878] GetProcessHeap () returned 0x1130000 [0058.878] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.878] GetProcessHeap () returned 0x1130000 [0058.878] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.878] GetProcessHeap () returned 0x1130000 [0058.878] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x11759c8 [0058.878] GetProcessHeap () returned 0x1130000 [0058.878] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.879] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.879] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.879] CloseHandle (hObject=0x3c0) returned 0 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.879] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 431 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0058.879] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0058.879] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175a90 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x11757c0 [0058.879] GetProcessHeap () returned 0x1130000 [0058.879] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.880] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.880] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.880] CloseHandle (hObject=0x3c0) returned 0 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.880] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 432 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.880] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.880] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175b30 [0058.880] GetProcessHeap () returned 0x1130000 [0058.880] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.881] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.881] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.881] CloseHandle (hObject=0x3c0) returned 0 [0058.881] GetProcessHeap () returned 0x1130000 [0058.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.881] GetProcessHeap () returned 0x1130000 [0058.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.881] GetProcessHeap () returned 0x1130000 [0058.881] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.881] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 433 [0058.881] GetProcessHeap () returned 0x1130000 [0058.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.881] GetProcessHeap () returned 0x1130000 [0058.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.881] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.881] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.881] GetProcessHeap () returned 0x1130000 [0058.881] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.882] GetProcessHeap () returned 0x1130000 [0058.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.882] GetProcessHeap () returned 0x1130000 [0058.882] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0058.882] GetProcessHeap () returned 0x1130000 [0058.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.882] GetProcessHeap () returned 0x1130000 [0058.882] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0058.882] GetProcessHeap () returned 0x1130000 [0058.882] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.882] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.882] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.882] CloseHandle (hObject=0x3c0) returned 0 [0058.882] GetProcessHeap () returned 0x1130000 [0058.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.882] GetProcessHeap () returned 0x1130000 [0058.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.882] GetProcessHeap () returned 0x1130000 [0058.882] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.883] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 434 [0058.883] GetProcessHeap () returned 0x1130000 [0058.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.883] GetProcessHeap () returned 0x1130000 [0058.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0058.883] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0058.883] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.883] GetProcessHeap () returned 0x1130000 [0058.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.883] GetProcessHeap () returned 0x1130000 [0058.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.883] GetProcessHeap () returned 0x1130000 [0058.883] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0058.883] GetProcessHeap () returned 0x1130000 [0058.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.883] GetProcessHeap () returned 0x1130000 [0058.883] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0058.883] GetProcessHeap () returned 0x1130000 [0058.883] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.884] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.884] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.884] CloseHandle (hObject=0x3c0) returned 0 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.884] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 435 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.884] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.884] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x30ef75c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x30ef75c*=0x0, lpOverlapped=0x0) returned 0 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175ae0 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.884] GetProcessHeap () returned 0x1130000 [0058.884] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.885] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.885] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x30ef778, lpOverlapped=0x0) returned 0 [0058.885] CloseHandle (hObject=0x3c0) returned 0 [0058.885] GetProcessHeap () returned 0x1130000 [0058.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0058.885] GetProcessHeap () returned 0x1130000 [0058.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.885] GetProcessHeap () returned 0x1130000 [0058.885] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.885] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 436 Thread: id = 5 os_tid = 0xd64 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0053.205] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.205] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150af8, Size=0x20) returned 0x1175a18 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ab8 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.205] GetProcessHeap () returned 0x1130000 [0053.205] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.205] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.206] GetProcessHeap () returned 0x1130000 [0053.206] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.207] GetProcessHeap () returned 0x1130000 [0053.207] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.208] GetProcessHeap () returned 0x1130000 [0053.208] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1157838 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0053.209] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.209] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.209] CloseHandle (hObject=0x3b0) returned 0 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.209] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 14 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.209] GetProcessHeap () returned 0x1130000 [0053.209] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0053.209] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0053.209] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3697100 [0053.210] ReadFile (in: hFile=0x3b0, lpBuffer=0x3697100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x3697100, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11756d0 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x11756f8 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.210] GetProcessHeap () returned 0x1130000 [0053.210] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.210] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0053.211] GetProcessHeap () returned 0x1130000 [0053.211] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.212] GetProcessHeap () returned 0x1130000 [0053.212] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1157838 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.213] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.213] GetProcessHeap () returned 0x1130000 [0053.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0053.214] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.214] WriteFile (in: hFile=0x3b0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.214] CloseHandle (hObject=0x3b0) returned 0 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3697100 | out: hHeap=0x1130000) returned 1 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.214] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 15 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0053.214] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36900c8 [0053.214] ReadFile (in: hFile=0x3b0, lpBuffer=0x36900c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36900c8, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175888 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175b30 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.214] GetProcessHeap () returned 0x1130000 [0053.214] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.215] GetProcessHeap () returned 0x1130000 [0053.215] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.216] GetProcessHeap () returned 0x1130000 [0053.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.217] GetProcessHeap () returned 0x1130000 [0053.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.218] GetProcessHeap () returned 0x1130000 [0053.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.218] GetProcessHeap () returned 0x1130000 [0053.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.218] GetProcessHeap () returned 0x1130000 [0053.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.218] GetProcessHeap () returned 0x1130000 [0053.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1157838 [0053.218] GetProcessHeap () returned 0x1130000 [0053.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.218] GetProcessHeap () returned 0x1130000 [0053.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.218] GetProcessHeap () returned 0x1130000 [0053.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0053.218] GetProcessHeap () returned 0x1130000 [0053.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0053.219] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.219] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.219] CloseHandle (hObject=0x3b0) returned 0 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36900c8 | out: hHeap=0x1130000) returned 1 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.219] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 16 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0053.219] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0053.219] ReadFile (in: hFile=0x3b0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175a18 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175b58 [0053.219] GetProcessHeap () returned 0x1130000 [0053.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.219] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.220] GetProcessHeap () returned 0x1130000 [0053.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.220] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.221] GetProcessHeap () returned 0x1130000 [0053.221] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.221] GetProcessHeap () returned 0x1130000 [0053.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.222] GetProcessHeap () returned 0x1130000 [0053.222] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1157838 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0053.223] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.223] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.223] CloseHandle (hObject=0x3b0) returned 0 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.223] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 17 [0053.223] GetProcessHeap () returned 0x1130000 [0053.223] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759c8 [0053.224] SystemFunction036 (in: RandomBuffer=0x11759c8, RandomBufferLength=0x20 | out: RandomBuffer=0x11759c8) returned 1 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3697100 [0053.224] ReadFile (in: hFile=0x3bc, lpBuffer=0x3697100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x3697100, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175ba8 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b30 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.224] GetProcessHeap () returned 0x1130000 [0053.224] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.224] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.225] GetProcessHeap () returned 0x1130000 [0053.225] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c58 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c58 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.226] GetProcessHeap () returned 0x1130000 [0053.226] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.226] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1157838 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.227] GetProcessHeap () returned 0x1130000 [0053.227] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1157838 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1157838 | out: hHeap=0x1130000) returned 1 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0053.228] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.228] WriteFile (in: hFile=0x3bc, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.228] CloseHandle (hObject=0x3bc) returned 0 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3697100 | out: hHeap=0x1130000) returned 1 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.228] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 18 [0053.228] GetProcessHeap () returned 0x1130000 [0053.228] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0053.229] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\*") returned 32 [0053.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf12666ac, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0053.229] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\.") returned 32 [0053.229] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf12666ac, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.229] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\..") returned 33 [0053.229] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.229] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 39 [0053.230] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.293] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.293] GetProcessHeap () returned 0x1130000 [0053.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0053.296] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.wctc") returned 44 [0053.296] CloseHandle (hObject=0x3bc) returned 1 [0053.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.wctc")) returned 1 [0053.298] GetProcessHeap () returned 0x1130000 [0053.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0053.298] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 38 [0053.298] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.298] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.298] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 48 [0053.298] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.299] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.299] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.299] GetProcessHeap () returned 0x1130000 [0053.299] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0053.299] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.wctc") returned 53 [0053.299] CloseHandle (hObject=0x3bc) returned 1 [0053.299] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.wctc")) returned 1 [0053.300] GetProcessHeap () returned 0x1130000 [0053.300] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0053.300] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 39 [0053.300] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.300] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12666ac, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf12666ac, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf12666ac, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.300] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\read_me.txt") returned 42 [0053.300] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.300] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.300] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.300] CloseHandle (hObject=0x3bc) returned 1 [0053.300] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.300] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 49 [0053.300] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.300] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.300] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.300] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.300] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.300] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.301] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.301] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.301] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.301] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.301] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.301] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.301] GetProcessHeap () returned 0x1130000 [0053.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0053.301] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.wctc") returned 54 [0053.301] CloseHandle (hObject=0x3bc) returned 1 [0053.301] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.wctc")) returned 1 [0053.301] GetProcessHeap () returned 0x1130000 [0053.301] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0053.301] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 40 [0053.301] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.301] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.301] FindClose (in: hFindFile=0x1170aa0 | out: hFindFile=0x1170aa0) returned 1 [0053.302] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1032\\read_me.txt") returned 42 [0053.302] GetProcessHeap () returned 0x1130000 [0053.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0053.302] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 9 [0053.302] GetProcessHeap () returned 0x1130000 [0053.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.303] GetProcessHeap () returned 0x1130000 [0053.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.304] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\*") returned 32 [0053.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf12666ac, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.304] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\.") returned 32 [0053.304] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf12666ac, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.304] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\..") returned 33 [0053.304] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.304] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 39 [0053.304] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.304] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.305] GetProcessHeap () returned 0x1130000 [0053.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0053.305] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.wctc") returned 44 [0053.305] CloseHandle (hObject=0x3bc) returned 1 [0053.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.wctc")) returned 1 [0053.307] GetProcessHeap () returned 0x1130000 [0053.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0053.307] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 41 [0053.307] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.307] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.307] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 48 [0053.307] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.308] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.308] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.308] GetProcessHeap () returned 0x1130000 [0053.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0053.308] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.wctc") returned 53 [0053.308] CloseHandle (hObject=0x3bc) returned 1 [0053.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.wctc")) returned 1 [0053.309] GetProcessHeap () returned 0x1130000 [0053.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0053.309] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 42 [0053.309] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.309] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12666ac, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf12666ac, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf12666ac, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.309] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\read_me.txt") returned 42 [0053.309] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.309] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.309] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.309] CloseHandle (hObject=0x3bc) returned 1 [0053.309] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.309] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 49 [0053.309] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.309] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.309] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.309] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.309] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.309] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.309] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.309] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.310] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.310] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.310] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.310] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.310] GetProcessHeap () returned 0x1130000 [0053.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0053.310] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.wctc") returned 54 [0053.310] CloseHandle (hObject=0x3bc) returned 1 [0053.310] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.wctc")) returned 1 [0053.310] GetProcessHeap () returned 0x1130000 [0053.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0053.310] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 43 [0053.310] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.310] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.310] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.310] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1033\\read_me.txt") returned 42 [0053.310] GetProcessHeap () returned 0x1130000 [0053.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.310] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 10 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0053.311] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36930e0 [0053.311] ReadFile (in: hFile=0x3bc, lpBuffer=0x36930e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36930e0, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11758d8 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175928 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.311] GetProcessHeap () returned 0x1130000 [0053.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.312] GetProcessHeap () returned 0x1130000 [0053.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.312] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e328 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e328 | out: hHeap=0x1130000) returned 1 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0053.313] GetProcessHeap () returned 0x1130000 [0053.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c00b8 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c00b8 | out: hHeap=0x1130000) returned 1 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c00b8 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c00b8 | out: hHeap=0x1130000) returned 1 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c00b8 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c00b8 | out: hHeap=0x1130000) returned 1 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c00b8 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c00b8 | out: hHeap=0x1130000) returned 1 [0053.314] GetProcessHeap () returned 0x1130000 [0053.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c00b8 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c00b8 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c00b8 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c00b8 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x36c00b8 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c00b8 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0053.315] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.315] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.315] CloseHandle (hObject=0x3bc) returned 0 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36930e0 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0053.315] GetProcessHeap () returned 0x1130000 [0053.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.315] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 19 [0053.316] GetProcessHeap () returned 0x1130000 [0053.316] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0053.316] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\*") returned 32 [0053.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.316] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\.") returned 32 [0053.316] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.316] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\..") returned 33 [0053.316] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.316] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 39 [0053.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.316] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.317] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.317] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.317] GetProcessHeap () returned 0x1130000 [0053.317] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.317] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.wctc") returned 44 [0053.317] CloseHandle (hObject=0x3bc) returned 1 [0053.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.wctc")) returned 1 [0053.318] GetProcessHeap () returned 0x1130000 [0053.318] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.318] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 44 [0053.318] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.318] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.318] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 48 [0053.318] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.319] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.319] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.319] GetProcessHeap () returned 0x1130000 [0053.319] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.319] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.wctc") returned 53 [0053.319] CloseHandle (hObject=0x3bc) returned 1 [0053.319] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.wctc")) returned 1 [0053.320] GetProcessHeap () returned 0x1130000 [0053.320] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.320] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 45 [0053.320] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.320] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128c7d1, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf128c7d1, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.320] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\read_me.txt") returned 42 [0053.320] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.320] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.320] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.320] CloseHandle (hObject=0x3bc) returned 1 [0053.320] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.320] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 49 [0053.320] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.320] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.320] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.320] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.320] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.321] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.321] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.321] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.321] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.321] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.321] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.321] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.321] GetProcessHeap () returned 0x1130000 [0053.321] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.321] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.wctc") returned 54 [0053.321] CloseHandle (hObject=0x3bc) returned 1 [0053.321] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.wctc")) returned 1 [0053.321] GetProcessHeap () returned 0x1130000 [0053.321] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.321] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 46 [0053.321] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.321] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.321] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.322] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1035\\read_me.txt") returned 42 [0053.322] GetProcessHeap () returned 0x1130000 [0053.322] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0053.322] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 11 [0053.322] GetProcessHeap () returned 0x1130000 [0053.322] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0053.324] GetProcessHeap () returned 0x1130000 [0053.324] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0053.324] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\*") returned 32 [0053.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0053.324] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\.") returned 32 [0053.324] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.324] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\..") returned 33 [0053.325] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.325] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 39 [0053.325] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.325] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.325] GetProcessHeap () returned 0x1130000 [0053.325] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0053.326] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.wctc") returned 44 [0053.326] CloseHandle (hObject=0x3bc) returned 1 [0053.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.wctc")) returned 1 [0053.328] GetProcessHeap () returned 0x1130000 [0053.328] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0053.328] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 47 [0053.328] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.328] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.328] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 48 [0053.328] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.328] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.328] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.329] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.329] GetProcessHeap () returned 0x1130000 [0053.329] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0053.329] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.wctc") returned 53 [0053.329] CloseHandle (hObject=0x3bc) returned 1 [0053.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.wctc")) returned 1 [0053.329] GetProcessHeap () returned 0x1130000 [0053.329] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0053.329] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 48 [0053.329] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.329] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128c7d1, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf128c7d1, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.329] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\read_me.txt") returned 42 [0053.329] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.329] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.329] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.329] CloseHandle (hObject=0x3bc) returned 1 [0053.329] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.329] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 49 [0053.330] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.330] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.330] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.330] GetProcessHeap () returned 0x1130000 [0053.330] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdfa0 [0053.330] wnsprintfW (in: pszDest=0x11bdfa0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.wctc") returned 54 [0053.330] CloseHandle (hObject=0x3bc) returned 1 [0053.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.wctc")) returned 1 [0053.331] GetProcessHeap () returned 0x1130000 [0053.331] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0053.331] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 49 [0053.331] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.331] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.331] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0053.331] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1036\\read_me.txt") returned 42 [0053.331] GetProcessHeap () returned 0x1130000 [0053.331] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0053.331] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 12 [0053.331] GetProcessHeap () returned 0x1130000 [0053.331] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0053.331] GetProcessHeap () returned 0x1130000 [0053.331] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3600058 [0053.331] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\*") returned 32 [0053.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170b20 [0053.331] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\.") returned 32 [0053.331] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.331] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\..") returned 33 [0053.331] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.331] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 39 [0053.331] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.332] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.332] GetProcessHeap () returned 0x1130000 [0053.332] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.333] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.wctc") returned 44 [0053.333] CloseHandle (hObject=0x3bc) returned 1 [0053.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.wctc")) returned 1 [0053.544] GetProcessHeap () returned 0x1130000 [0053.544] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.544] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 69 [0053.544] QueueUserWorkItem (Function=0x1294e00, Context=0x3bc, Flags=0x0) returned 1 [0053.544] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.544] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 48 [0053.544] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.544] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.545] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.545] GetProcessHeap () returned 0x1130000 [0053.545] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.545] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.wctc") returned 53 [0053.545] CloseHandle (hObject=0x3c0) returned 1 [0053.545] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.wctc")) returned 1 [0053.546] GetProcessHeap () returned 0x1130000 [0053.546] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.546] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 70 [0053.546] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.546] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128c7d1, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf128c7d1, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf128c7d1, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.546] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\read_me.txt") returned 42 [0053.546] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.546] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.546] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.546] CloseHandle (hObject=0x3c0) returned 1 [0053.546] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.546] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 49 [0053.546] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0053.547] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.547] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.547] GetProcessHeap () returned 0x1130000 [0053.547] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.547] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.wctc") returned 54 [0053.547] CloseHandle (hObject=0x3c0) returned 1 [0053.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.wctc")) returned 1 [0053.548] GetProcessHeap () returned 0x1130000 [0053.548] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.548] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 71 [0053.548] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0053.548] FindNextFileW (in: hFindFile=0x1170b20, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.548] FindClose (in: hFindFile=0x1170b20 | out: hFindFile=0x1170b20) returned 0 [0053.548] wnsprintfW (in: pszDest=0x3600058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1037\\read_me.txt") returned 42 [0053.548] GetProcessHeap () returned 0x1130000 [0053.548] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0053.548] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 16 [0053.548] GetProcessHeap () returned 0x1130000 [0053.548] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3610060 | out: hHeap=0x1130000) returned 1 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0053.550] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.550] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b88, Size=0x20) returned 0x1175720 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175a90 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0053.550] GetProcessHeap () returned 0x1130000 [0053.550] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.550] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.551] GetProcessHeap () returned 0x1130000 [0053.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.551] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177ad8 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177ad8 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.552] GetProcessHeap () returned 0x1130000 [0053.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.552] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.553] GetProcessHeap () returned 0x1130000 [0053.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11bcf98 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0053.554] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.554] WriteFile (in: hFile=0x3b0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.554] CloseHandle (hObject=0x3b0) returned 0 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.554] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 25 [0053.554] GetProcessHeap () returned 0x1130000 [0053.554] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.555] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\*") returned 32 [0053.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15d3b81, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.555] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\.") returned 32 [0053.555] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15d3b81, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.555] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\..") returned 33 [0053.555] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.555] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 39 [0053.555] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.555] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.555] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.555] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.555] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.556] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.556] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.556] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.556] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.556] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.556] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.556] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.556] GetProcessHeap () returned 0x1130000 [0053.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.557] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.wctc") returned 44 [0053.557] CloseHandle (hObject=0x3b4) returned 1 [0053.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.wctc")) returned 1 [0053.558] GetProcessHeap () returned 0x1130000 [0053.558] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.558] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 72 [0053.558] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.558] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.558] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 48 [0053.558] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.559] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.559] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.559] GetProcessHeap () returned 0x1130000 [0053.559] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.559] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.wctc") returned 53 [0053.559] CloseHandle (hObject=0x3b4) returned 1 [0053.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.wctc")) returned 1 [0053.560] GetProcessHeap () returned 0x1130000 [0053.560] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.560] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 73 [0053.560] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.560] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15d3b81, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf15d3b81, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf15d3b81, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.560] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\read_me.txt") returned 42 [0053.560] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.560] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.560] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.560] CloseHandle (hObject=0x3b4) returned 1 [0053.560] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.560] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 49 [0053.560] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.560] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.560] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.560] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.560] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.561] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.561] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.561] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.561] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.561] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.561] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.561] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.561] GetProcessHeap () returned 0x1130000 [0053.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.561] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.wctc") returned 54 [0053.561] CloseHandle (hObject=0x3b4) returned 1 [0053.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.wctc")) returned 1 [0053.561] GetProcessHeap () returned 0x1130000 [0053.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.562] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 74 [0053.562] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.562] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.562] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.562] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1042\\read_me.txt") returned 42 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.562] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 17 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0053.562] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.562] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a40 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11756f8 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.562] GetProcessHeap () returned 0x1130000 [0053.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.563] GetProcessHeap () returned 0x1130000 [0053.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.563] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c28 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c28 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.564] GetProcessHeap () returned 0x1130000 [0053.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.564] GetProcessHeap () returned 0x1130000 [0053.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.565] GetProcessHeap () returned 0x1130000 [0053.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.565] GetProcessHeap () returned 0x1130000 [0053.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bcf98 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11bcf98 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bcf98 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0053.566] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.566] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.566] CloseHandle (hObject=0x3b0) returned 0 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0053.566] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 26 [0053.566] GetProcessHeap () returned 0x1130000 [0053.566] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0053.567] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\*") returned 32 [0053.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15f9e88, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.567] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\.") returned 32 [0053.567] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15f9e88, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0053.567] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\..") returned 33 [0053.567] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.567] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 39 [0053.567] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.567] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.568] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.568] GetProcessHeap () returned 0x1130000 [0053.568] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.568] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.wctc") returned 44 [0053.568] CloseHandle (hObject=0x3b4) returned 1 [0053.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.wctc")) returned 1 [0053.570] GetProcessHeap () returned 0x1130000 [0053.570] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.570] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 75 [0053.570] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.570] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.570] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 48 [0053.570] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.570] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.570] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.571] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.571] GetProcessHeap () returned 0x1130000 [0053.571] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.571] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.wctc") returned 53 [0053.571] CloseHandle (hObject=0x3b4) returned 1 [0053.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.wctc")) returned 1 [0053.571] GetProcessHeap () returned 0x1130000 [0053.571] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.571] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 76 [0053.571] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.571] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15f9e88, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf15f9e88, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf15f9e88, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.571] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\read_me.txt") returned 42 [0053.571] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.571] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.571] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.571] CloseHandle (hObject=0x3b4) returned 1 [0053.572] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.572] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 49 [0053.572] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.572] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.572] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.572] GetProcessHeap () returned 0x1130000 [0053.572] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.572] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.wctc") returned 54 [0053.572] CloseHandle (hObject=0x3b4) returned 1 [0053.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.wctc")) returned 1 [0053.573] GetProcessHeap () returned 0x1130000 [0053.573] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.573] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 77 [0053.573] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.573] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.573] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.573] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1043\\read_me.txt") returned 42 [0053.573] GetProcessHeap () returned 0x1130000 [0053.573] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0053.573] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 18 [0053.573] GetProcessHeap () returned 0x1130000 [0053.573] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3650080 | out: hHeap=0x1130000) returned 1 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0053.575] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.575] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x11758d8 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175ae0 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.575] GetProcessHeap () returned 0x1130000 [0053.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.576] GetProcessHeap () returned 0x1130000 [0053.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.576] GetProcessHeap () returned 0x1130000 [0053.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c58 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c58 | out: hHeap=0x1130000) returned 1 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.764] GetProcessHeap () returned 0x1130000 [0053.764] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.765] GetProcessHeap () returned 0x1130000 [0053.765] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.765] GetProcessHeap () returned 0x1130000 [0053.765] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.765] GetProcessHeap () returned 0x1130000 [0053.765] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.765] GetProcessHeap () returned 0x1130000 [0053.765] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.765] GetProcessHeap () returned 0x1130000 [0053.765] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.765] GetProcessHeap () returned 0x1130000 [0053.765] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.765] GetProcessHeap () returned 0x1130000 [0053.765] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.765] GetProcessHeap () returned 0x1130000 [0053.765] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159350 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0053.766] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.766] WriteFile (in: hFile=0x3b0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0053.766] CloseHandle (hObject=0x3b0) returned 0 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0053.766] GetProcessHeap () returned 0x1130000 [0053.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0053.767] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 30 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0053.767] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0053.767] ReadFile (in: hFile=0x3b4, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11758d8 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175798 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.767] GetProcessHeap () returned 0x1130000 [0053.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.768] GetProcessHeap () returned 0x1130000 [0053.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.768] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b08 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b08 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.769] GetProcessHeap () returned 0x1130000 [0053.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159350 [0053.770] GetProcessHeap () returned 0x1130000 [0053.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.770] GetProcessHeap () returned 0x1130000 [0053.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.771] GetProcessHeap () returned 0x1130000 [0053.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0053.771] GetProcessHeap () returned 0x1130000 [0053.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.771] GetProcessHeap () returned 0x1130000 [0053.771] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0053.771] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.259] WriteFile (in: hFile=0x3b4, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0054.259] CloseHandle (hObject=0x3b4) returned 0 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.259] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 33 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0054.627] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0054.627] ReadFile (in: hFile=0x3bc, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175770 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175a40 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.627] GetProcessHeap () returned 0x1130000 [0054.627] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.627] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.628] GetProcessHeap () returned 0x1130000 [0054.628] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.629] GetProcessHeap () returned 0x1130000 [0054.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.630] GetProcessHeap () returned 0x1130000 [0054.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.630] GetProcessHeap () returned 0x1130000 [0054.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0054.631] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.631] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0054.631] CloseHandle (hObject=0x3bc) returned 0 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0054.631] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 47 [0055.025] GetProcessHeap () returned 0x1130000 [0055.025] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3960108 [0055.025] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\*") returned 19 [0055.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170aa0 [0055.025] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\.") returned 19 [0055.025] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.025] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\..") returned 20 [0055.026] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.026] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 33 [0055.026] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.026] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0055.026] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 33 [0055.026] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.026] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18a85c4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18a85c4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.026] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt") returned 29 [0055.026] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt" (normalized: "c:\\boot\\cs-cz\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0055.026] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.026] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.026] CloseHandle (hObject=0x3c0) returned 1 [0055.026] FindNextFileW (in: hFindFile=0x1170aa0, lpFindFileData=0x37df2b8 | out: lpFindFileData=0x37df2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18a85c4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18a85c4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.026] FindClose (in: hFindFile=0x1170aa0 | out: hFindFile=0x1170aa0) returned 1 [0055.084] wnsprintfW (in: pszDest=0x3960108, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt") returned 29 [0055.084] GetProcessHeap () returned 0x1130000 [0055.084] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3960108 | out: hHeap=0x1130000) returned 1 [0055.084] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 34 [0055.085] GetProcessHeap () returned 0x1130000 [0055.085] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0055.301] GetProcessHeap () returned 0x1130000 [0055.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.301] GetProcessHeap () returned 0x1130000 [0055.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756d0 [0055.301] SystemFunction036 (in: RandomBuffer=0x11756d0, RandomBufferLength=0x20 | out: RandomBuffer=0x11756d0) returned 1 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0055.302] ReadFile (in: hFile=0x3b4, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175a40 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.302] GetProcessHeap () returned 0x1130000 [0055.302] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0055.303] GetProcessHeap () returned 0x1130000 [0055.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.304] GetProcessHeap () returned 0x1130000 [0055.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.305] GetProcessHeap () returned 0x1130000 [0055.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0055.306] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.306] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0055.306] CloseHandle (hObject=0x3b4) returned 1 [0055.306] GetProcessHeap () returned 0x1130000 [0055.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0055.306] GetProcessHeap () returned 0x1130000 [0055.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0055.306] GetProcessHeap () returned 0x1130000 [0055.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.306] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 50 [0055.437] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0055.438] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.438] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37df47c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x37df47c*=0x0, lpOverlapped=0x0) returned 0 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175860 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.438] GetProcessHeap () returned 0x1130000 [0055.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.438] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.439] GetProcessHeap () returned 0x1130000 [0055.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177838 [0055.439] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e520 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177838 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e520 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.440] GetProcessHeap () returned 0x1130000 [0055.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.440] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.441] GetProcessHeap () returned 0x1130000 [0055.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.442] GetProcessHeap () returned 0x1130000 [0055.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.442] GetProcessHeap () returned 0x1130000 [0055.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.442] GetProcessHeap () returned 0x1130000 [0055.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0055.442] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.442] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x37df498, lpOverlapped=0x0) returned 0 [0055.442] CloseHandle (hObject=0x3c0) returned 0 [0055.442] GetProcessHeap () returned 0x1130000 [0055.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.442] GetProcessHeap () returned 0x1130000 [0055.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0055.442] GetProcessHeap () returned 0x1130000 [0055.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.442] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 51 Thread: id = 6 os_tid = 0x4e4 [0053.577] GetProcessHeap () returned 0x1130000 [0053.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.578] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\*") returned 32 [0053.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15f9e88, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72ee416c, dwReserved1=0x3adf794, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0053.578] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\.") returned 32 [0053.578] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf15f9e88, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72ee416c, dwReserved1=0x3adf794, cFileName="..", cAlternateFileName="")) returned 1 [0053.578] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\..") returned 33 [0053.578] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x72ee416c, dwReserved1=0x3adf794, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.578] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 39 [0053.578] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.579] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.579] GetProcessHeap () returned 0x1130000 [0053.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.580] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.wctc") returned 44 [0053.580] CloseHandle (hObject=0x3b4) returned 1 [0053.580] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.wctc")) returned 1 [0053.582] GetProcessHeap () returned 0x1130000 [0053.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.582] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 78 [0053.582] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.582] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x72ee416c, dwReserved1=0x3adf794, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.582] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 48 [0053.582] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.582] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.582] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.582] GetProcessHeap () returned 0x1130000 [0053.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.583] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.wctc") returned 53 [0053.583] CloseHandle (hObject=0x3b4) returned 1 [0053.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.wctc")) returned 1 [0053.583] GetProcessHeap () returned 0x1130000 [0053.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.583] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 79 [0053.583] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.583] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15f9e88, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf15f9e88, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf15f9e88, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x72ee416c, dwReserved1=0x3adf794, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.583] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\read_me.txt") returned 42 [0053.583] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.583] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.583] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.583] CloseHandle (hObject=0x3b4) returned 1 [0053.583] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x72ee416c, dwReserved1=0x3adf794, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.583] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 49 [0053.584] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.584] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.584] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.584] GetProcessHeap () returned 0x1130000 [0053.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.584] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.wctc") returned 54 [0053.584] CloseHandle (hObject=0x3b4) returned 1 [0053.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.wctc")) returned 1 [0053.585] GetProcessHeap () returned 0x1130000 [0053.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.585] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 80 [0053.585] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.585] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x72ee416c, dwReserved1=0x3adf794, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.585] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0053.585] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1044\\read_me.txt") returned 42 [0053.585] GetProcessHeap () returned 0x1130000 [0053.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.585] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 19 [0053.585] GetProcessHeap () returned 0x1130000 [0053.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3660088 | out: hHeap=0x1130000) returned 1 [0053.585] GetProcessHeap () returned 0x1130000 [0053.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.585] GetProcessHeap () returned 0x1130000 [0053.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a90 [0053.585] SystemFunction036 (in: RandomBuffer=0x1175a90, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a90) returned 1 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0053.586] ReadFile (in: hFile=0x3b0, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b30 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bf8, Size=0x20) returned 0x1175860 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.586] GetProcessHeap () returned 0x1130000 [0053.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.586] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.587] GetProcessHeap () returned 0x1130000 [0053.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.588] GetProcessHeap () returned 0x1130000 [0053.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.588] GetProcessHeap () returned 0x1130000 [0053.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11bdc58 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.589] GetProcessHeap () returned 0x1130000 [0053.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.590] GetProcessHeap () returned 0x1130000 [0053.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0053.590] GetProcessHeap () returned 0x1130000 [0053.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.590] GetProcessHeap () returned 0x1130000 [0053.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0053.590] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.590] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0053.590] CloseHandle (hObject=0x3b0) returned 0 [0053.590] GetProcessHeap () returned 0x1130000 [0053.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0053.590] GetProcessHeap () returned 0x1130000 [0053.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0053.590] GetProcessHeap () returned 0x1130000 [0053.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.590] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 27 [0053.590] GetProcessHeap () returned 0x1130000 [0053.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.590] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\*") returned 32 [0053.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1620079, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.590] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\.") returned 32 [0053.590] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1620079, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0053.590] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\..") returned 33 [0053.590] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.590] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 39 [0053.590] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.590] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.591] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.591] GetProcessHeap () returned 0x1130000 [0053.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.591] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.wctc") returned 44 [0053.591] CloseHandle (hObject=0x3b4) returned 1 [0053.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.wctc")) returned 1 [0053.594] GetProcessHeap () returned 0x1130000 [0053.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.594] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 81 [0053.594] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.594] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 48 [0053.594] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.594] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.594] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.594] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.594] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.595] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.595] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.595] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.595] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.595] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.595] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.595] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.595] GetProcessHeap () returned 0x1130000 [0053.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.595] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.wctc") returned 53 [0053.595] CloseHandle (hObject=0x3b4) returned 1 [0053.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.wctc")) returned 1 [0053.595] GetProcessHeap () returned 0x1130000 [0053.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.595] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 82 [0053.595] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.595] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1620079, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1620079, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1620079, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.595] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\read_me.txt") returned 42 [0053.596] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.596] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.596] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.596] CloseHandle (hObject=0x3b4) returned 1 [0053.596] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.596] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 49 [0053.596] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.596] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.596] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.596] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.596] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.596] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.596] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.596] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.596] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.596] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.597] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.597] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.597] GetProcessHeap () returned 0x1130000 [0053.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x35e0048 [0053.597] wnsprintfW (in: pszDest=0x35e0048, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.wctc") returned 54 [0053.597] CloseHandle (hObject=0x3b4) returned 1 [0053.597] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.wctc")) returned 1 [0053.597] GetProcessHeap () returned 0x1130000 [0053.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0053.597] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 83 [0053.597] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.597] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.597] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.597] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1045\\read_me.txt") returned 42 [0053.597] GetProcessHeap () returned 0x1130000 [0053.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.597] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 20 [0053.597] GetProcessHeap () returned 0x1130000 [0053.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0053.600] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0053.600] ReadFile (in: hFile=0x3b0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11758b0 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175ba8 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.600] GetProcessHeap () returned 0x1130000 [0053.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0053.601] GetProcessHeap () returned 0x1130000 [0053.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.601] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.602] GetProcessHeap () returned 0x1130000 [0053.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.602] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.603] GetProcessHeap () returned 0x1130000 [0053.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11bdc58 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0053.604] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.604] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0053.604] CloseHandle (hObject=0x3b0) returned 0 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0053.604] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 28 [0053.604] GetProcessHeap () returned 0x1130000 [0053.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.605] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\*") returned 32 [0053.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf166cf4c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.605] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\.") returned 32 [0053.605] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf166cf4c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0053.605] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\..") returned 33 [0053.605] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.605] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 39 [0053.605] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.605] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.606] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.606] GetProcessHeap () returned 0x1130000 [0053.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.607] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.wctc") returned 44 [0053.607] CloseHandle (hObject=0x3b4) returned 1 [0053.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.wctc")) returned 1 [0053.609] GetProcessHeap () returned 0x1130000 [0053.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.609] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 84 [0053.609] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.609] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.609] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 48 [0053.609] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.609] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.609] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.609] GetProcessHeap () returned 0x1130000 [0053.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.610] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.wctc") returned 53 [0053.610] CloseHandle (hObject=0x3b4) returned 1 [0053.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.wctc")) returned 1 [0053.610] GetProcessHeap () returned 0x1130000 [0053.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.610] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 85 [0053.610] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.610] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf166cf4c, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf166cf4c, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf166cf4c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.610] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\read_me.txt") returned 42 [0053.610] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.610] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.610] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.610] CloseHandle (hObject=0x3b4) returned 1 [0053.610] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.610] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 49 [0053.610] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0053.611] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.611] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.611] GetProcessHeap () returned 0x1130000 [0053.611] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0053.611] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.wctc") returned 54 [0053.611] CloseHandle (hObject=0x3b4) returned 1 [0053.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.wctc")) returned 1 [0053.612] GetProcessHeap () returned 0x1130000 [0053.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0053.612] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 86 [0053.612] QueueUserWorkItem (Function=0x1294e00, Context=0x3b4, Flags=0x0) returned 1 [0053.612] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.612] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.612] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1046\\read_me.txt") returned 42 [0053.612] GetProcessHeap () returned 0x1130000 [0053.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.612] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 21 [0053.612] GetProcessHeap () returned 0x1130000 [0053.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3670090 | out: hHeap=0x1130000) returned 1 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0053.614] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0053.614] ReadFile (in: hFile=0x3b0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175770 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.614] GetProcessHeap () returned 0x1130000 [0053.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0053.615] GetProcessHeap () returned 0x1130000 [0053.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0053.615] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.616] GetProcessHeap () returned 0x1130000 [0053.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.617] GetProcessHeap () returned 0x1130000 [0053.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11bdc58 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0053.618] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0053.618] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0053.618] CloseHandle (hObject=0x3b0) returned 0 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0053.618] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 29 [0053.618] GetProcessHeap () returned 0x1130000 [0053.618] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.619] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\*") returned 32 [0053.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf166cf4c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170ba0 [0053.620] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\.") returned 32 [0053.620] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf166cf4c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0053.620] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\..") returned 33 [0053.620] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.620] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 39 [0053.620] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.771] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.771] GetProcessHeap () returned 0x1130000 [0053.771] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.772] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.wctc") returned 44 [0053.772] CloseHandle (hObject=0x3b8) returned 1 [0053.772] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.wctc")) returned 1 [0053.774] GetProcessHeap () returned 0x1130000 [0053.774] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.774] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 90 [0053.774] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.774] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.774] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 48 [0053.774] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.774] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.774] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.774] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.774] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.775] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.775] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.775] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.775] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.775] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.775] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.775] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.775] GetProcessHeap () returned 0x1130000 [0053.775] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.775] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.wctc") returned 53 [0053.775] CloseHandle (hObject=0x3b8) returned 1 [0053.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.wctc")) returned 1 [0053.775] GetProcessHeap () returned 0x1130000 [0053.775] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.775] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 91 [0053.775] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.775] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf166cf4c, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf166cf4c, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf166cf4c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.776] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\read_me.txt") returned 42 [0053.776] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.776] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.776] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.776] CloseHandle (hObject=0x3b8) returned 1 [0053.776] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.776] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 49 [0053.776] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.776] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.776] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.776] GetProcessHeap () returned 0x1130000 [0053.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11ddfb0 [0053.777] wnsprintfW (in: pszDest=0x11ddfb0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.wctc") returned 54 [0053.777] CloseHandle (hObject=0x3b8) returned 1 [0053.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.wctc")) returned 1 [0053.777] GetProcessHeap () returned 0x1130000 [0053.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0053.777] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 92 [0053.777] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.777] FindNextFileW (in: hFindFile=0x1170ba0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.777] FindClose (in: hFindFile=0x1170ba0 | out: hFindFile=0x1170ba0) returned 1 [0053.777] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1049\\read_me.txt") returned 42 [0053.777] GetProcessHeap () returned 0x1130000 [0053.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.777] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 23 [0053.777] GetProcessHeap () returned 0x1130000 [0053.777] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.777] GetProcessHeap () returned 0x1130000 [0053.777] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.777] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\*") returned 32 [0053.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170c60 [0053.778] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\.") returned 32 [0053.778] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0053.778] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\..") returned 33 [0053.778] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.778] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 39 [0053.778] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.778] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.778] GetProcessHeap () returned 0x1130000 [0053.779] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.779] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.wctc") returned 44 [0053.779] CloseHandle (hObject=0x3b8) returned 1 [0053.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.wctc")) returned 1 [0053.780] GetProcessHeap () returned 0x1130000 [0053.780] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.780] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 93 [0053.780] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.780] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.780] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 48 [0053.780] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.780] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.781] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.781] GetProcessHeap () returned 0x1130000 [0053.781] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.781] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.wctc") returned 53 [0053.781] CloseHandle (hObject=0x3b8) returned 1 [0053.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.wctc")) returned 1 [0053.781] GetProcessHeap () returned 0x1130000 [0053.782] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.782] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 94 [0053.782] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.782] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1692539, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1692539, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.782] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\read_me.txt") returned 42 [0053.782] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.782] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.782] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.782] CloseHandle (hObject=0x3b8) returned 1 [0053.782] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.782] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 49 [0053.782] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.782] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.782] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.782] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.782] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.782] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.782] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.782] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.782] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.783] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.783] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.783] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.783] GetProcessHeap () returned 0x1130000 [0053.783] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0053.783] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.wctc") returned 54 [0053.783] CloseHandle (hObject=0x3b8) returned 1 [0053.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.wctc")) returned 1 [0053.783] GetProcessHeap () returned 0x1130000 [0053.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0053.783] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 95 [0053.783] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.783] FindNextFileW (in: hFindFile=0x1170c60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.783] FindClose (in: hFindFile=0x1170c60 | out: hFindFile=0x1170c60) returned 1 [0053.783] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1053\\read_me.txt") returned 42 [0053.783] GetProcessHeap () returned 0x1130000 [0053.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.783] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 24 [0053.783] GetProcessHeap () returned 0x1130000 [0053.783] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36a00a8 | out: hHeap=0x1130000) returned 1 [0053.785] GetProcessHeap () returned 0x1130000 [0053.785] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36a00a8 [0053.786] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\*") returned 32 [0053.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.786] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\.") returned 32 [0053.786] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0053.786] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\..") returned 33 [0053.786] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.786] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 39 [0053.786] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.786] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.787] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.787] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.787] GetProcessHeap () returned 0x1130000 [0053.787] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.787] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.wctc") returned 44 [0053.787] CloseHandle (hObject=0x3b8) returned 1 [0053.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.wctc")) returned 1 [0053.789] GetProcessHeap () returned 0x1130000 [0053.789] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.789] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 96 [0053.789] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.789] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.789] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 48 [0053.789] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.789] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.789] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.790] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.790] GetProcessHeap () returned 0x1130000 [0053.790] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.790] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.wctc") returned 53 [0053.790] CloseHandle (hObject=0x3b8) returned 1 [0053.790] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.wctc")) returned 1 [0053.790] GetProcessHeap () returned 0x1130000 [0053.790] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.790] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 97 [0053.790] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.790] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1692539, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1692539, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.791] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\read_me.txt") returned 42 [0053.791] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.791] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.791] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.791] CloseHandle (hObject=0x3b8) returned 1 [0053.791] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.791] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 49 [0053.791] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.791] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.791] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.792] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.792] GetProcessHeap () returned 0x1130000 [0053.792] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.792] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.wctc") returned 54 [0053.792] CloseHandle (hObject=0x3b8) returned 1 [0053.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.wctc")) returned 1 [0053.792] GetProcessHeap () returned 0x1130000 [0053.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.792] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 98 [0053.792] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.792] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.792] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.792] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\1055\\read_me.txt") returned 42 [0053.792] GetProcessHeap () returned 0x1130000 [0053.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36a00a8 | out: hHeap=0x1130000) returned 1 [0053.792] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 25 [0053.792] GetProcessHeap () returned 0x1130000 [0053.792] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11edfb8 | out: hHeap=0x1130000) returned 1 [0053.793] GetProcessHeap () returned 0x1130000 [0053.793] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36a00a8 [0053.793] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\*") returned 32 [0053.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0053.793] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\.") returned 32 [0053.793] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0053.793] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\..") returned 33 [0053.793] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0053.793] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 39 [0053.793] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0053.793] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0053.794] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0053.794] GetProcessHeap () returned 0x1130000 [0053.794] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.794] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.wctc") returned 44 [0053.794] CloseHandle (hObject=0x3b8) returned 1 [0053.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.wctc")) returned 1 [0053.795] GetProcessHeap () returned 0x1130000 [0053.795] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.795] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 99 [0053.795] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.795] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0053.795] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 48 [0053.795] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.795] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0053.795] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0053.795] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0053.796] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0053.796] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0053.796] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0053.796] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0053.796] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0053.796] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0053.796] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0053.796] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0053.796] GetProcessHeap () returned 0x1130000 [0053.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.796] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.wctc") returned 53 [0053.796] CloseHandle (hObject=0x3b8) returned 1 [0053.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.wctc")) returned 1 [0053.797] GetProcessHeap () returned 0x1130000 [0053.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.797] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 100 [0053.797] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.797] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1692539, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1692539, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1692539, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0053.797] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\read_me.txt") returned 42 [0053.797] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.797] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0053.797] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0053.797] CloseHandle (hObject=0x3b8) returned 1 [0053.797] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0053.797] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 49 [0053.797] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0053.797] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0053.797] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0053.797] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0053.798] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0053.798] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0053.798] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0053.798] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0053.798] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0053.798] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0053.798] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0053.798] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0053.798] GetProcessHeap () returned 0x1130000 [0053.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0053.798] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.wctc") returned 54 [0053.798] CloseHandle (hObject=0x3b8) returned 1 [0053.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.wctc")) returned 1 [0053.798] GetProcessHeap () returned 0x1130000 [0053.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0053.798] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 101 [0053.798] QueueUserWorkItem (Function=0x1294e00, Context=0x3b8, Flags=0x0) returned 1 [0053.798] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x3b0, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0053.798] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0053.799] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\2052\\read_me.txt") returned 42 [0053.799] GetProcessHeap () returned 0x1130000 [0053.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36a00a8 | out: hHeap=0x1130000) returned 1 [0053.799] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 26 [0053.799] GetProcessHeap () returned 0x1130000 [0053.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36b00b0 | out: hHeap=0x1130000) returned 1 [0053.800] GetProcessHeap () returned 0x1130000 [0053.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0053.800] GetProcessHeap () returned 0x1130000 [0053.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0053.800] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0053.800] GetProcessHeap () returned 0x1130000 [0053.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0053.800] ReadFile (in: hFile=0x3b4, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0053.800] GetProcessHeap () returned 0x1130000 [0053.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0053.800] GetProcessHeap () returned 0x1130000 [0053.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0053.800] GetProcessHeap () returned 0x1130000 [0053.800] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175ba8 [0053.800] GetProcessHeap () returned 0x1130000 [0053.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0053.800] GetProcessHeap () returned 0x1130000 [0053.800] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175950 [0053.800] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0053.801] GetProcessHeap () returned 0x1130000 [0053.801] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b08 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e208 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b08 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e208 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1159350 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.802] GetProcessHeap () returned 0x1130000 [0053.802] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.802] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.803] GetProcessHeap () returned 0x1130000 [0053.803] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.803] GetProcessHeap () returned 0x1130000 [0053.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bda50 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc58 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bda50 | out: hHeap=0x1130000) returned 1 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1159350 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc58 | out: hHeap=0x1130000) returned 1 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1159350 | out: hHeap=0x1130000) returned 1 [0053.804] GetProcessHeap () returned 0x1130000 [0053.804] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0053.804] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.259] WriteFile (in: hFile=0x3b4, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.259] CloseHandle (hObject=0x3b4) returned 0 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0054.259] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 34 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a90 [0054.259] SystemFunction036 (in: RandomBuffer=0x1175a90, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a90) returned 1 [0054.259] GetProcessHeap () returned 0x1130000 [0054.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0054.260] ReadFile (in: hFile=0x3b4, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175720 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175ab8 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.260] GetProcessHeap () returned 0x1130000 [0054.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0054.260] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0054.261] GetProcessHeap () returned 0x1130000 [0054.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.262] GetProcessHeap () returned 0x1130000 [0054.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.262] GetProcessHeap () returned 0x1130000 [0054.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0054.263] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.263] WriteFile (in: hFile=0x3b4, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.263] CloseHandle (hObject=0x3b4) returned 0 [0054.263] GetProcessHeap () returned 0x1130000 [0054.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.264] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 35 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0054.264] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3698108 [0054.264] ReadFile (in: hFile=0x3b4, lpBuffer=0x3698108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3698108, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c98, Size=0x20) returned 0x1175a68 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11759a0 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.264] GetProcessHeap () returned 0x1130000 [0054.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.265] GetProcessHeap () returned 0x1130000 [0054.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.265] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779e8 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779e8 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.266] GetProcessHeap () returned 0x1130000 [0054.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.267] GetProcessHeap () returned 0x1130000 [0054.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0054.268] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.268] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.268] CloseHandle (hObject=0x3b4) returned 0 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3698108 | out: hHeap=0x1130000) returned 1 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0054.268] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 36 [0054.268] GetProcessHeap () returned 0x1130000 [0054.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0054.269] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\*") returned 32 [0054.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.269] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\.") returned 32 [0054.269] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0054.269] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\..") returned 33 [0054.269] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0054.269] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 39 [0054.269] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.269] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0054.269] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0054.269] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0054.269] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0054.269] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0054.270] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0054.270] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0054.270] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0054.270] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0054.270] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0054.270] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0054.270] GetProcessHeap () returned 0x1130000 [0054.270] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0054.270] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.wctc") returned 44 [0054.271] CloseHandle (hObject=0x3c0) returned 1 [0054.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.wctc")) returned 1 [0054.273] GetProcessHeap () returned 0x1130000 [0054.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0054.273] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 105 [0054.273] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.273] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0054.273] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 48 [0054.273] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.274] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0054.274] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0054.274] GetProcessHeap () returned 0x1130000 [0054.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0054.274] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.wctc") returned 53 [0054.274] CloseHandle (hObject=0x3c0) returned 1 [0054.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.wctc")) returned 1 [0054.275] GetProcessHeap () returned 0x1130000 [0054.275] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0054.275] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 106 [0054.275] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.275] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf16b88a2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf16b88a2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0054.275] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\read_me.txt") returned 42 [0054.275] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.275] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0054.275] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0054.275] CloseHandle (hObject=0x3c0) returned 1 [0054.275] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0054.275] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 49 [0054.275] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.275] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0054.275] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0054.275] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0054.275] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0054.275] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0054.276] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0054.276] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0054.276] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0054.276] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0054.276] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0054.276] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0054.276] GetProcessHeap () returned 0x1130000 [0054.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0054.276] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.wctc") returned 54 [0054.276] CloseHandle (hObject=0x3c0) returned 1 [0054.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.wctc")) returned 1 [0054.276] GetProcessHeap () returned 0x1130000 [0054.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0054.276] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 107 [0054.276] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.276] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0054.276] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.276] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3076\\read_me.txt") returned 42 [0054.276] GetProcessHeap () returned 0x1130000 [0054.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0054.277] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 28 [0054.277] GetProcessHeap () returned 0x1130000 [0054.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37e0048 | out: hHeap=0x1130000) returned 1 [0054.277] GetProcessHeap () returned 0x1130000 [0054.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37e0048 [0054.277] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\*") returned 32 [0054.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.277] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\.") returned 32 [0054.277] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0054.277] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\..") returned 33 [0054.277] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0054.277] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 39 [0054.277] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch=".wctc") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="read_me.txt") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="autoexec.bat") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="desktop.ini") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="autorun.inf") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="iconcache.db") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="bootsect.bak") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="boot.ini") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0054.277] StrStrW (lpFirst="eula.rtf", lpSrch="thumbs.db") returned 0x0 [0054.278] GetProcessHeap () returned 0x1130000 [0054.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0054.278] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.wctc") returned 44 [0054.278] CloseHandle (hObject=0x3c0) returned 1 [0054.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.wctc" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.wctc")) returned 1 [0054.279] GetProcessHeap () returned 0x1130000 [0054.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0054.279] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 108 [0054.279] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.279] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0054.280] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 48 [0054.280] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.280] StrStrW (lpFirst="LocalizedData.xml", lpSrch=".wctc") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="read_me.txt") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="autoexec.bat") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="desktop.ini") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="autorun.inf") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="iconcache.db") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="bootsect.bak") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="boot.ini") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="ntuser.dat.log") returned 0x0 [0054.280] StrStrW (lpFirst="localizeddata.xml", lpSrch="thumbs.db") returned 0x0 [0054.280] GetProcessHeap () returned 0x1130000 [0054.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0054.280] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.wctc") returned 53 [0054.281] CloseHandle (hObject=0x3c0) returned 1 [0054.281] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.wctc")) returned 1 [0054.281] GetProcessHeap () returned 0x1130000 [0054.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0054.282] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 109 [0054.282] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.282] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf16b88a2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf16b88a2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf16b88a2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0054.282] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\read_me.txt") returned 42 [0054.282] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.282] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0054.282] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0054.282] CloseHandle (hObject=0x3c0) returned 1 [0054.282] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0054.282] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 49 [0054.282] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.282] StrStrW (lpFirst="SetupResources.dll", lpSrch=".wctc") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="read_me.txt") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="autoexec.bat") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="desktop.ini") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="autorun.inf") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="iconcache.db") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="bootsect.bak") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="boot.ini") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="ntuser.dat.log") returned 0x0 [0054.282] StrStrW (lpFirst="setupresources.dll", lpSrch="thumbs.db") returned 0x0 [0054.282] GetProcessHeap () returned 0x1130000 [0054.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0054.283] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.wctc") returned 54 [0054.283] CloseHandle (hObject=0x3c0) returned 1 [0054.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.wctc" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.wctc")) returned 1 [0054.284] GetProcessHeap () returned 0x1130000 [0054.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0054.284] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 110 [0054.284] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.284] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="setupresources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0054.284] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.284] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\3082\\read_me.txt") returned 42 [0054.284] GetProcessHeap () returned 0x1130000 [0054.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37e0048 | out: hHeap=0x1130000) returned 1 [0054.284] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 29 [0054.284] GetProcessHeap () returned 0x1130000 [0054.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37f0050 | out: hHeap=0x1130000) returned 1 [0054.285] GetProcessHeap () returned 0x1130000 [0054.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11fdfc0 [0054.286] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\*") returned 34 [0054.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf16dea23, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.286] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\.") returned 34 [0054.286] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf16dea23, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0054.286] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\..") returned 35 [0054.286] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0054.286] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 50 [0054.286] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.286] StrStrW (lpFirst="Parameterinfo.xml", lpSrch=".wctc") returned 0x0 [0054.286] StrStrW (lpFirst="parameterinfo.xml", lpSrch="read_me.txt") returned 0x0 [0054.286] StrStrW (lpFirst="parameterinfo.xml", lpSrch="autoexec.bat") returned 0x0 [0054.287] StrStrW (lpFirst="parameterinfo.xml", lpSrch="desktop.ini") returned 0x0 [0054.287] StrStrW (lpFirst="parameterinfo.xml", lpSrch="autorun.inf") returned 0x0 [0054.287] StrStrW (lpFirst="parameterinfo.xml", lpSrch="ntuser.dat") returned 0x0 [0054.287] StrStrW (lpFirst="parameterinfo.xml", lpSrch="iconcache.db") returned 0x0 [0054.287] StrStrW (lpFirst="parameterinfo.xml", lpSrch="bootsect.bak") returned 0x0 [0054.287] StrStrW (lpFirst="parameterinfo.xml", lpSrch="boot.ini") returned 0x0 [0054.287] StrStrW (lpFirst="parameterinfo.xml", lpSrch="ntuser.dat.log") returned 0x0 [0054.287] StrStrW (lpFirst="parameterinfo.xml", lpSrch="thumbs.db") returned 0x0 [0054.287] GetProcessHeap () returned 0x1130000 [0054.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0054.288] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.wctc") returned 55 [0054.288] CloseHandle (hObject=0x3c0) returned 1 [0054.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.wctc")) returned 1 [0054.288] GetProcessHeap () returned 0x1130000 [0054.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0054.288] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 111 [0054.288] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.288] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf16dea23, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf16dea23, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1882312, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0054.288] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\read_me.txt") returned 44 [0054.288] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\client\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.288] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0054.288] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0054.288] CloseHandle (hObject=0x3c0) returned 1 [0054.288] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0054.288] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 43 [0054.289] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.289] StrStrW (lpFirst="UiInfo.xml", lpSrch=".wctc") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="read_me.txt") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="autoexec.bat") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="desktop.ini") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="autorun.inf") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="ntuser.dat") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="iconcache.db") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="bootsect.bak") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="boot.ini") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="ntuser.dat.log") returned 0x0 [0054.289] StrStrW (lpFirst="uiinfo.xml", lpSrch="thumbs.db") returned 0x0 [0054.289] GetProcessHeap () returned 0x1130000 [0054.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3630070 [0054.289] wnsprintfW (in: pszDest=0x3630070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.wctc") returned 48 [0054.289] CloseHandle (hObject=0x3c0) returned 1 [0054.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.wctc")) returned 1 [0054.289] GetProcessHeap () returned 0x1130000 [0054.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0054.290] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 112 [0054.290] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.290] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x3b4, dwReserved1=0x77c08fcf, cFileName="uiinfo.xml", cAlternateFileName="")) returned 0 [0054.290] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.290] wnsprintfW (in: pszDest=0x11fdfc0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Client\\read_me.txt") returned 44 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0054.290] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 30 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0054.290] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0054.290] ReadFile (in: hFile=0x3b4, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175900 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c98, Size=0x20) returned 0x1175a18 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.290] GetProcessHeap () returned 0x1130000 [0054.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.290] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.291] GetProcessHeap () returned 0x1130000 [0054.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.291] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.292] GetProcessHeap () returned 0x1130000 [0054.292] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.293] GetProcessHeap () returned 0x1130000 [0054.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0054.294] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.294] WriteFile (in: hFile=0x3b4, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.294] CloseHandle (hObject=0x3b4) returned 0 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.294] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 37 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0054.294] GetProcessHeap () returned 0x1130000 [0054.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0054.295] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0054.295] ReadFile (in: hFile=0x3bc, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175b08 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175928 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.295] GetProcessHeap () returned 0x1130000 [0054.295] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.296] GetProcessHeap () returned 0x1130000 [0054.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.296] GetProcessHeap () returned 0x1130000 [0054.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.296] GetProcessHeap () returned 0x1130000 [0054.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.296] GetProcessHeap () returned 0x1130000 [0054.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.296] GetProcessHeap () returned 0x1130000 [0054.296] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.296] GetProcessHeap () returned 0x1130000 [0054.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.460] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.461] GetProcessHeap () returned 0x1130000 [0054.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.461] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.462] GetProcessHeap () returned 0x1130000 [0054.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.462] GetProcessHeap () returned 0x1130000 [0054.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0054.463] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.463] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.463] CloseHandle (hObject=0x3bc) returned 0 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0054.463] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 39 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0054.463] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3698108 [0054.463] ReadFile (in: hFile=0x3bc, lpBuffer=0x3698108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3698108, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175798 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0054.463] GetProcessHeap () returned 0x1130000 [0054.463] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175978 [0054.463] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.464] GetProcessHeap () returned 0x1130000 [0054.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.464] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779e8 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779e8 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0054.465] GetProcessHeap () returned 0x1130000 [0054.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.465] GetProcessHeap () returned 0x1130000 [0054.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.466] GetProcessHeap () returned 0x1130000 [0054.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0054.467] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.467] WriteFile (in: hFile=0x3bc, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.467] CloseHandle (hObject=0x3bc) returned 0 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3698108 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0054.467] GetProcessHeap () returned 0x1130000 [0054.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.467] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 40 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0054.468] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3698108 [0054.468] ReadFile (in: hFile=0x3bc, lpBuffer=0x3698108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3698108, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175978 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.468] GetProcessHeap () returned 0x1130000 [0054.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.468] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.469] GetProcessHeap () returned 0x1130000 [0054.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0054.469] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.470] GetProcessHeap () returned 0x1130000 [0054.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.470] GetProcessHeap () returned 0x1130000 [0054.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.471] GetProcessHeap () returned 0x1130000 [0054.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.471] GetProcessHeap () returned 0x1130000 [0054.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0054.472] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.472] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.472] CloseHandle (hObject=0x3bc) returned 0 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3698108 | out: hHeap=0x1130000) returned 1 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0054.472] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 41 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0054.472] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0054.472] ReadFile (in: hFile=0x3bc, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150af8, Size=0x20) returned 0x11757c0 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0054.472] GetProcessHeap () returned 0x1130000 [0054.472] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0054.472] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.473] GetProcessHeap () returned 0x1130000 [0054.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.473] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e010 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e010 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.474] GetProcessHeap () returned 0x1130000 [0054.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0054.474] GetProcessHeap () returned 0x1130000 [0054.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.475] GetProcessHeap () returned 0x1130000 [0054.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0054.476] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.476] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.476] CloseHandle (hObject=0x3bc) returned 0 [0054.476] GetProcessHeap () returned 0x1130000 [0054.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0054.477] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 42 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0054.477] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3698108 [0054.477] ReadFile (in: hFile=0x3bc, lpBuffer=0x3698108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3698108, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175ab8 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175770 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.477] GetProcessHeap () returned 0x1130000 [0054.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.477] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0054.478] GetProcessHeap () returned 0x1130000 [0054.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.478] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.479] GetProcessHeap () returned 0x1130000 [0054.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.479] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.480] GetProcessHeap () returned 0x1130000 [0054.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0054.481] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.481] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.481] CloseHandle (hObject=0x3bc) returned 0 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3698108 | out: hHeap=0x1130000) returned 1 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0054.481] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 43 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0054.481] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0054.481] ReadFile (in: hFile=0x3bc, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0054.481] GetProcessHeap () returned 0x1130000 [0054.481] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175860 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175900 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.482] GetProcessHeap () returned 0x1130000 [0054.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a48 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0054.483] GetProcessHeap () returned 0x1130000 [0054.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a48 | out: hHeap=0x1130000) returned 1 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.484] GetProcessHeap () returned 0x1130000 [0054.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.485] GetProcessHeap () returned 0x1130000 [0054.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0054.486] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.486] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.486] CloseHandle (hObject=0x3bc) returned 0 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0054.486] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 44 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0054.486] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0054.486] ReadFile (in: hFile=0x3bc, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175748 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175a90 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.486] GetProcessHeap () returned 0x1130000 [0054.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0054.487] GetProcessHeap () returned 0x1130000 [0054.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.487] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177838 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177838 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.488] GetProcessHeap () returned 0x1130000 [0054.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.489] GetProcessHeap () returned 0x1130000 [0054.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0054.490] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.490] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.490] CloseHandle (hObject=0x3bc) returned 0 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0054.490] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 45 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0054.490] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0054.490] GetProcessHeap () returned 0x1130000 [0054.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0054.490] ReadFile (in: hFile=0x3bc, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.490] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175ab8 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175928 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0054.491] GetProcessHeap () returned 0x1130000 [0054.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e208 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e208 | out: hHeap=0x1130000) returned 1 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0054.492] GetProcessHeap () returned 0x1130000 [0054.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.493] GetProcessHeap () returned 0x1130000 [0054.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0054.494] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.494] WriteFile (in: hFile=0x3bc, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.494] CloseHandle (hObject=0x3bc) returned 0 [0054.494] GetProcessHeap () returned 0x1130000 [0054.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0054.494] GetProcessHeap () returned 0x1130000 [0054.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.495] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 46 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0054.495] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36960f8 [0054.495] ReadFile (in: hFile=0x3bc, lpBuffer=0x36960f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36960f8, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c98, Size=0x20) returned 0x1175a40 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x11756f8 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.495] GetProcessHeap () returned 0x1130000 [0054.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.495] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.496] GetProcessHeap () returned 0x1130000 [0054.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.497] GetProcessHeap () returned 0x1130000 [0054.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.498] GetProcessHeap () returned 0x1130000 [0054.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0054.499] GetProcessHeap () returned 0x1130000 [0054.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.499] GetProcessHeap () returned 0x1130000 [0054.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0054.499] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.499] WriteFile (in: hFile=0x3bc, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.499] CloseHandle (hObject=0x3bc) returned 0 [0054.499] GetProcessHeap () returned 0x1130000 [0054.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36960f8 | out: hHeap=0x1130000) returned 1 [0054.499] GetProcessHeap () returned 0x1130000 [0054.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.631] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 48 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0054.631] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0054.631] ReadFile (in: hFile=0x3bc, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175a18 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0054.631] GetProcessHeap () returned 0x1130000 [0054.631] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.632] GetProcessHeap () returned 0x1130000 [0054.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.632] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.633] GetProcessHeap () returned 0x1130000 [0054.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.633] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.634] GetProcessHeap () returned 0x1130000 [0054.634] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0054.635] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.635] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0054.635] CloseHandle (hObject=0x3bc) returned 0 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0054.635] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 49 [0054.635] GetProcessHeap () returned 0x1130000 [0054.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.636] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*") returned 36 [0054.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1882312, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.637] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\.") returned 36 [0054.637] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf1882312, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0054.637] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\..") returned 37 [0054.637] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0054.637] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 52 [0054.637] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.637] StrStrW (lpFirst="Parameterinfo.xml", lpSrch=".wctc") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="read_me.txt") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="autoexec.bat") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="desktop.ini") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="autorun.inf") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="ntuser.dat") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="iconcache.db") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="bootsect.bak") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="boot.ini") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="ntuser.dat.log") returned 0x0 [0054.637] StrStrW (lpFirst="parameterinfo.xml", lpSrch="thumbs.db") returned 0x0 [0054.637] GetProcessHeap () returned 0x1130000 [0054.637] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3980118 [0054.638] wnsprintfW (in: pszDest=0x3980118, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.wctc") returned 57 [0054.638] CloseHandle (hObject=0x3c0) returned 1 [0054.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.wctc")) returned 1 [0054.639] GetProcessHeap () returned 0x1130000 [0054.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3980118 | out: hHeap=0x1130000) returned 1 [0054.639] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 113 [0054.639] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.639] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1882312, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1882312, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1882312, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0054.639] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\read_me.txt") returned 46 [0054.639] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.639] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0054.639] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0054.639] CloseHandle (hObject=0x3c0) returned 1 [0054.639] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0054.639] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 45 [0054.639] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.639] StrStrW (lpFirst="UiInfo.xml", lpSrch=".wctc") returned 0x0 [0054.639] StrStrW (lpFirst="uiinfo.xml", lpSrch="read_me.txt") returned 0x0 [0054.639] StrStrW (lpFirst="uiinfo.xml", lpSrch="autoexec.bat") returned 0x0 [0054.640] StrStrW (lpFirst="uiinfo.xml", lpSrch="desktop.ini") returned 0x0 [0054.640] StrStrW (lpFirst="uiinfo.xml", lpSrch="autorun.inf") returned 0x0 [0054.640] StrStrW (lpFirst="uiinfo.xml", lpSrch="ntuser.dat") returned 0x0 [0054.640] StrStrW (lpFirst="uiinfo.xml", lpSrch="iconcache.db") returned 0x0 [0054.640] StrStrW (lpFirst="uiinfo.xml", lpSrch="bootsect.bak") returned 0x0 [0054.640] StrStrW (lpFirst="uiinfo.xml", lpSrch="boot.ini") returned 0x0 [0054.640] StrStrW (lpFirst="uiinfo.xml", lpSrch="ntuser.dat.log") returned 0x0 [0054.640] StrStrW (lpFirst="uiinfo.xml", lpSrch="thumbs.db") returned 0x0 [0054.640] GetProcessHeap () returned 0x1130000 [0054.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3980118 [0054.640] wnsprintfW (in: pszDest=0x3980118, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.wctc") returned 50 [0054.640] CloseHandle (hObject=0x3c0) returned 1 [0054.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.wctc" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.wctc")) returned 1 [0054.641] GetProcessHeap () returned 0x1130000 [0054.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3980118 | out: hHeap=0x1130000) returned 1 [0054.641] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 114 [0054.641] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.641] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="uiinfo.xml", cAlternateFileName="")) returned 0 [0054.641] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0054.641] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Extended\\read_me.txt") returned 46 [0054.641] GetProcessHeap () returned 0x1130000 [0054.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.641] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 31 [0054.641] GetProcessHeap () returned 0x1130000 [0054.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdfa0 | out: hHeap=0x1130000) returned 1 [0054.641] GetProcessHeap () returned 0x1130000 [0054.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdc28 [0054.641] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*") returned 36 [0054.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0054.641] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\.") returned 36 [0054.641] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0054.641] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\..") returned 37 [0054.641] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0054.641] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 44 [0054.641] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.642] StrStrW (lpFirst="Print.ico", lpSrch=".wctc") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="read_me.txt") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="autoexec.bat") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="desktop.ini") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="autorun.inf") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="ntuser.dat") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="iconcache.db") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="bootsect.bak") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="boot.ini") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.642] StrStrW (lpFirst="print.ico", lpSrch="thumbs.db") returned 0x0 [0054.642] GetProcessHeap () returned 0x1130000 [0054.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.642] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.wctc") returned 49 [0054.642] CloseHandle (hObject=0x3c0) returned 1 [0054.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.wctc")) returned 1 [0054.643] GetProcessHeap () returned 0x1130000 [0054.643] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.643] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 115 [0054.643] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.643] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18a85c4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18a85c4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0054.643] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\read_me.txt") returned 46 [0054.643] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\read_me.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.643] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0054.643] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0054.643] CloseHandle (hObject=0x3c0) returned 1 [0054.643] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0054.643] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 46 [0054.643] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.644] StrStrW (lpFirst="Rotate1.ico", lpSrch=".wctc") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="read_me.txt") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="autoexec.bat") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="desktop.ini") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="autorun.inf") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="ntuser.dat") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="iconcache.db") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="bootsect.bak") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="boot.ini") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.644] StrStrW (lpFirst="rotate1.ico", lpSrch="thumbs.db") returned 0x0 [0054.644] GetProcessHeap () returned 0x1130000 [0054.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.644] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.wctc") returned 51 [0054.644] CloseHandle (hObject=0x3c0) returned 1 [0054.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.wctc")) returned 1 [0054.644] GetProcessHeap () returned 0x1130000 [0054.644] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.644] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 116 [0054.644] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.644] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0054.645] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 46 [0054.645] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.645] StrStrW (lpFirst="Rotate2.ico", lpSrch=".wctc") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="read_me.txt") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="autoexec.bat") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="desktop.ini") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="autorun.inf") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="ntuser.dat") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="iconcache.db") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="bootsect.bak") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="boot.ini") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.645] StrStrW (lpFirst="rotate2.ico", lpSrch="thumbs.db") returned 0x0 [0054.645] GetProcessHeap () returned 0x1130000 [0054.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.645] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.wctc") returned 51 [0054.645] CloseHandle (hObject=0x3c0) returned 1 [0054.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.wctc")) returned 1 [0054.646] GetProcessHeap () returned 0x1130000 [0054.646] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.646] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 117 [0054.646] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.646] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0054.646] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 46 [0054.646] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.646] StrStrW (lpFirst="Rotate3.ico", lpSrch=".wctc") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="read_me.txt") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="autoexec.bat") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="desktop.ini") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="autorun.inf") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="ntuser.dat") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="iconcache.db") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="bootsect.bak") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="boot.ini") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.646] StrStrW (lpFirst="rotate3.ico", lpSrch="thumbs.db") returned 0x0 [0054.646] GetProcessHeap () returned 0x1130000 [0054.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.646] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.wctc") returned 51 [0054.646] CloseHandle (hObject=0x3c0) returned 1 [0054.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.wctc")) returned 1 [0054.647] GetProcessHeap () returned 0x1130000 [0054.647] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.647] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 118 [0054.647] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.647] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0054.647] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 46 [0054.647] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.647] StrStrW (lpFirst="Rotate4.ico", lpSrch=".wctc") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="read_me.txt") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="autoexec.bat") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="desktop.ini") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="autorun.inf") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="ntuser.dat") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="iconcache.db") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="bootsect.bak") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="boot.ini") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.648] StrStrW (lpFirst="rotate4.ico", lpSrch="thumbs.db") returned 0x0 [0054.648] GetProcessHeap () returned 0x1130000 [0054.648] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.648] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.wctc") returned 51 [0054.648] CloseHandle (hObject=0x3c0) returned 1 [0054.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.wctc")) returned 1 [0054.648] GetProcessHeap () returned 0x1130000 [0054.648] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.648] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 119 [0054.648] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.649] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0054.649] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 46 [0054.649] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.649] StrStrW (lpFirst="Rotate5.ico", lpSrch=".wctc") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="read_me.txt") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="autoexec.bat") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="desktop.ini") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="autorun.inf") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="ntuser.dat") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="iconcache.db") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="bootsect.bak") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="boot.ini") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.649] StrStrW (lpFirst="rotate5.ico", lpSrch="thumbs.db") returned 0x0 [0054.649] GetProcessHeap () returned 0x1130000 [0054.649] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.649] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.wctc") returned 51 [0054.649] CloseHandle (hObject=0x3c0) returned 1 [0054.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.wctc")) returned 1 [0054.650] GetProcessHeap () returned 0x1130000 [0054.650] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.650] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 120 [0054.650] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.650] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0054.650] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 46 [0054.650] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.650] StrStrW (lpFirst="Rotate6.ico", lpSrch=".wctc") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="read_me.txt") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="autoexec.bat") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="desktop.ini") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="autorun.inf") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="ntuser.dat") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="iconcache.db") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="bootsect.bak") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="boot.ini") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.650] StrStrW (lpFirst="rotate6.ico", lpSrch="thumbs.db") returned 0x0 [0054.650] GetProcessHeap () returned 0x1130000 [0054.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.650] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.wctc") returned 51 [0054.650] CloseHandle (hObject=0x3c0) returned 1 [0054.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.wctc")) returned 1 [0054.651] GetProcessHeap () returned 0x1130000 [0054.651] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.651] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 121 [0054.651] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.651] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0054.651] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 46 [0054.651] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.651] StrStrW (lpFirst="Rotate7.ico", lpSrch=".wctc") returned 0x0 [0054.651] StrStrW (lpFirst="rotate7.ico", lpSrch="read_me.txt") returned 0x0 [0054.651] StrStrW (lpFirst="rotate7.ico", lpSrch="autoexec.bat") returned 0x0 [0054.651] StrStrW (lpFirst="rotate7.ico", lpSrch="desktop.ini") returned 0x0 [0054.651] StrStrW (lpFirst="rotate7.ico", lpSrch="autorun.inf") returned 0x0 [0054.651] StrStrW (lpFirst="rotate7.ico", lpSrch="ntuser.dat") returned 0x0 [0054.651] StrStrW (lpFirst="rotate7.ico", lpSrch="iconcache.db") returned 0x0 [0054.651] StrStrW (lpFirst="rotate7.ico", lpSrch="bootsect.bak") returned 0x0 [0054.652] StrStrW (lpFirst="rotate7.ico", lpSrch="boot.ini") returned 0x0 [0054.652] StrStrW (lpFirst="rotate7.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.652] StrStrW (lpFirst="rotate7.ico", lpSrch="thumbs.db") returned 0x0 [0054.652] GetProcessHeap () returned 0x1130000 [0054.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.652] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.wctc") returned 51 [0054.652] CloseHandle (hObject=0x3c0) returned 1 [0054.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.wctc")) returned 1 [0054.652] GetProcessHeap () returned 0x1130000 [0054.652] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.652] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 122 [0054.652] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0054.652] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 46 [0054.652] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.653] StrStrW (lpFirst="Rotate8.ico", lpSrch=".wctc") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="read_me.txt") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="autoexec.bat") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="desktop.ini") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="autorun.inf") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="ntuser.dat") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="iconcache.db") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="bootsect.bak") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="boot.ini") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.653] StrStrW (lpFirst="rotate8.ico", lpSrch="thumbs.db") returned 0x0 [0054.653] GetProcessHeap () returned 0x1130000 [0054.653] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.653] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.wctc") returned 51 [0054.653] CloseHandle (hObject=0x3c0) returned 1 [0054.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.wctc")) returned 1 [0054.654] GetProcessHeap () returned 0x1130000 [0054.654] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.654] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 123 [0054.654] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.654] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0054.654] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 43 [0054.654] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.654] StrStrW (lpFirst="Save.ico", lpSrch=".wctc") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="read_me.txt") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="autoexec.bat") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="desktop.ini") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="autorun.inf") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="ntuser.dat") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="iconcache.db") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="bootsect.bak") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="boot.ini") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.654] StrStrW (lpFirst="save.ico", lpSrch="thumbs.db") returned 0x0 [0054.655] GetProcessHeap () returned 0x1130000 [0054.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.655] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.wctc") returned 48 [0054.655] CloseHandle (hObject=0x3c0) returned 1 [0054.655] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.wctc")) returned 1 [0054.655] GetProcessHeap () returned 0x1130000 [0054.655] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.655] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 124 [0054.655] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.655] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0054.655] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 44 [0054.655] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.655] StrStrW (lpFirst="Setup.ico", lpSrch=".wctc") returned 0x0 [0054.655] StrStrW (lpFirst="setup.ico", lpSrch="read_me.txt") returned 0x0 [0054.655] StrStrW (lpFirst="setup.ico", lpSrch="autoexec.bat") returned 0x0 [0054.655] StrStrW (lpFirst="setup.ico", lpSrch="desktop.ini") returned 0x0 [0054.656] StrStrW (lpFirst="setup.ico", lpSrch="autorun.inf") returned 0x0 [0054.656] StrStrW (lpFirst="setup.ico", lpSrch="ntuser.dat") returned 0x0 [0054.656] StrStrW (lpFirst="setup.ico", lpSrch="iconcache.db") returned 0x0 [0054.656] StrStrW (lpFirst="setup.ico", lpSrch="bootsect.bak") returned 0x0 [0054.656] StrStrW (lpFirst="setup.ico", lpSrch="boot.ini") returned 0x0 [0054.656] StrStrW (lpFirst="setup.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.656] StrStrW (lpFirst="setup.ico", lpSrch="thumbs.db") returned 0x0 [0054.656] GetProcessHeap () returned 0x1130000 [0054.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.656] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.wctc") returned 49 [0054.656] CloseHandle (hObject=0x3c0) returned 1 [0054.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.wctc")) returned 1 [0054.656] GetProcessHeap () returned 0x1130000 [0054.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.656] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 125 [0054.656] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.656] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0054.656] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 43 [0054.656] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch=".wctc") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="read_me.txt") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="autoexec.bat") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="desktop.ini") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="autorun.inf") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="ntuser.dat") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="iconcache.db") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="bootsect.bak") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="boot.ini") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.657] StrStrW (lpFirst="stop.ico", lpSrch="thumbs.db") returned 0x0 [0054.657] GetProcessHeap () returned 0x1130000 [0054.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.657] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.wctc") returned 48 [0054.657] CloseHandle (hObject=0x3c0) returned 1 [0054.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.wctc")) returned 1 [0054.657] GetProcessHeap () returned 0x1130000 [0054.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.658] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 126 [0054.658] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.658] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0054.658] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 48 [0054.658] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.658] StrStrW (lpFirst="SysReqMet.ico", lpSrch=".wctc") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="read_me.txt") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="autoexec.bat") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="desktop.ini") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="autorun.inf") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="ntuser.dat") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="iconcache.db") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="bootsect.bak") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="boot.ini") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.658] StrStrW (lpFirst="sysreqmet.ico", lpSrch="thumbs.db") returned 0x0 [0054.658] GetProcessHeap () returned 0x1130000 [0054.658] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.658] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.wctc") returned 53 [0054.658] CloseHandle (hObject=0x3c0) returned 1 [0054.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.wctc")) returned 1 [0054.662] GetProcessHeap () returned 0x1130000 [0054.662] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.662] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 127 [0054.662] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.662] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0054.662] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 51 [0054.662] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.663] StrStrW (lpFirst="SysReqNotMet.ico", lpSrch=".wctc") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="read_me.txt") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="autoexec.bat") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="desktop.ini") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="autorun.inf") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="ntuser.dat") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="iconcache.db") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="bootsect.bak") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="boot.ini") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.663] StrStrW (lpFirst="sysreqnotmet.ico", lpSrch="thumbs.db") returned 0x0 [0054.663] GetProcessHeap () returned 0x1130000 [0054.663] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.663] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.wctc") returned 56 [0054.663] CloseHandle (hObject=0x3c0) returned 1 [0054.663] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.wctc")) returned 1 [0054.663] GetProcessHeap () returned 0x1130000 [0054.663] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.663] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 128 [0054.664] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.664] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0054.664] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 43 [0054.664] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch=".wctc") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="read_me.txt") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="autoexec.bat") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="desktop.ini") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="autorun.inf") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="ntuser.dat") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="iconcache.db") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="bootsect.bak") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="boot.ini") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="ntuser.dat.log") returned 0x0 [0054.664] StrStrW (lpFirst="warn.ico", lpSrch="thumbs.db") returned 0x0 [0054.664] GetProcessHeap () returned 0x1130000 [0054.664] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0054.664] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.wctc") returned 48 [0054.664] CloseHandle (hObject=0x3c0) returned 1 [0054.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.wctc" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.wctc")) returned 1 [0054.665] GetProcessHeap () returned 0x1130000 [0054.665] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0054.665] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 129 [0054.665] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.665] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0054.665] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0054.665] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\read_me.txt") returned 46 [0054.665] GetProcessHeap () returned 0x1130000 [0054.665] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.665] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 32 [0054.665] GetProcessHeap () returned 0x1130000 [0054.665] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdfa8 | out: hHeap=0x1130000) returned 1 [0054.665] GetProcessHeap () returned 0x1130000 [0054.665] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11bdc28 [0054.665] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\*") returned 13 [0054.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170920 [0054.665] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\.") returned 13 [0054.665] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0054.665] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\..") returned 14 [0054.665] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="BCD", cAlternateFileName="")) returned 1 [0054.665] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD") returned 15 [0054.665] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.665] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0054.666] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG") returned 19 [0054.666] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.666] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0054.666] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG1") returned 20 [0054.666] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.666] StrStrW (lpFirst="BCD.LOG1", lpSrch=".wctc") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="read_me.txt") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="autoexec.bat") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="desktop.ini") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="autorun.inf") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="ntuser.dat") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="iconcache.db") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="bootsect.bak") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="boot.ini") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="ntuser.dat.log") returned 0x0 [0054.666] StrStrW (lpFirst="bcd.log1", lpSrch="thumbs.db") returned 0x0 [0054.666] GetProcessHeap () returned 0x1130000 [0054.666] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdc30 [0054.666] wnsprintfW (in: pszDest=0x11cdc30, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG1.wctc") returned 25 [0054.666] CloseHandle (hObject=0x3c0) returned 1 [0054.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="\\\\?\\C:\\Boot\\BCD.LOG1.wctc" (normalized: "c:\\boot\\bcd.log1.wctc")) returned 1 [0054.667] GetProcessHeap () returned 0x1130000 [0054.667] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdc30 | out: hHeap=0x1130000) returned 1 [0054.667] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 130 [0054.667] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.667] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0054.667] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG2") returned 20 [0054.667] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0054.667] StrStrW (lpFirst="BCD.LOG2", lpSrch=".wctc") returned 0x0 [0054.667] StrStrW (lpFirst="bcd.log2", lpSrch="read_me.txt") returned 0x0 [0054.667] StrStrW (lpFirst="bcd.log2", lpSrch="autoexec.bat") returned 0x0 [0054.667] StrStrW (lpFirst="bcd.log2", lpSrch="desktop.ini") returned 0x0 [0054.667] StrStrW (lpFirst="bcd.log2", lpSrch="autorun.inf") returned 0x0 [0054.667] StrStrW (lpFirst="bcd.log2", lpSrch="ntuser.dat") returned 0x0 [0054.667] StrStrW (lpFirst="bcd.log2", lpSrch="iconcache.db") returned 0x0 [0054.667] StrStrW (lpFirst="bcd.log2", lpSrch="bootsect.bak") returned 0x0 [0054.668] StrStrW (lpFirst="bcd.log2", lpSrch="boot.ini") returned 0x0 [0054.668] StrStrW (lpFirst="bcd.log2", lpSrch="ntuser.dat.log") returned 0x0 [0054.668] StrStrW (lpFirst="bcd.log2", lpSrch="thumbs.db") returned 0x0 [0054.668] GetProcessHeap () returned 0x1130000 [0054.668] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdc30 [0054.668] wnsprintfW (in: pszDest=0x11cdc30, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG2.wctc") returned 25 [0054.668] CloseHandle (hObject=0x3c0) returned 1 [0054.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="\\\\?\\C:\\Boot\\BCD.LOG2.wctc" (normalized: "c:\\boot\\bcd.log2.wctc")) returned 1 [0054.668] GetProcessHeap () returned 0x1130000 [0054.668] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdc30 | out: hHeap=0x1130000) returned 1 [0054.668] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 131 [0054.668] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0054.668] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0054.668] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG") returned 17 [0054.668] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0054.668] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bootspaces.dll") returned 26 [0054.668] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.084] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0055.084] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned 24 [0055.084] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0055.166] StrStrW (lpFirst="BOOTSTAT.DAT", lpSrch=".wctc") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="read_me.txt") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="autoexec.bat") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="desktop.ini") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="autorun.inf") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="ntuser.dat") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="iconcache.db") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="bootsect.bak") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="boot.ini") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="ntuser.dat.log") returned 0x0 [0055.166] StrStrW (lpFirst="bootstat.dat", lpSrch="thumbs.db") returned 0x0 [0055.166] GetProcessHeap () returned 0x1130000 [0055.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3800058 [0055.166] wnsprintfW (in: pszDest=0x3800058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.wctc") returned 29 [0055.166] CloseHandle (hObject=0x3ac) returned 1 [0055.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.wctc" (normalized: "c:\\boot\\bootstat.dat.wctc")) returned 1 [0055.167] GetProcessHeap () returned 0x1130000 [0055.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3800058 | out: hHeap=0x1130000) returned 1 [0055.167] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 132 [0055.167] QueueUserWorkItem (Function=0x1294e00, Context=0x3ac, Flags=0x0) returned 1 [0055.167] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0055.167] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bootvhd.dll") returned 23 [0055.167] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.167] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0055.167] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ") returned 17 [0055.167] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="da-DK", cAlternateFileName="")) returned 1 [0055.167] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK") returned 17 [0055.167] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="de-DE", cAlternateFileName="")) returned 1 [0055.167] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE") returned 17 [0055.167] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="el-GR", cAlternateFileName="")) returned 1 [0055.167] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR") returned 17 [0055.167] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="en-GB", cAlternateFileName="")) returned 1 [0055.167] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB") returned 17 [0055.167] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="es-ES", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="es-MX", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="et-EE", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Fonts", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="it-IT", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\memtest.exe") returned 23 [0055.168] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0055.168] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL") returned 17 [0055.168] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc") returned 20 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources") returned 21 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS") returned 22 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS") returned 22 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA") returned 17 [0055.169] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0055.169] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b") returned 36 [0055.169] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.170] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0055.170] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN") returned 17 [0055.170] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0055.170] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK") returned 17 [0055.170] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0055.170] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW") returned 17 [0055.170] FindNextFileW (in: hFindFile=0x1170920, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0055.170] FindClose (in: hFindFile=0x1170920 | out: hFindFile=0x1170920) returned 1 [0055.170] wnsprintfW (in: pszDest=0x11bdc28, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\read_me.txt") returned 23 [0055.170] GetProcessHeap () returned 0x1130000 [0055.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0055.171] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 36 [0055.171] GetProcessHeap () returned 0x1130000 [0055.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0055.329] GetProcessHeap () returned 0x1130000 [0055.329] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.329] GetProcessHeap () returned 0x1130000 [0055.329] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0055.329] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0055.329] GetProcessHeap () returned 0x1130000 [0055.329] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0055.329] ReadFile (in: hFile=0x3c0, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ab8 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.456] GetProcessHeap () returned 0x1130000 [0055.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.456] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0055.457] GetProcessHeap () returned 0x1130000 [0055.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.458] GetProcessHeap () returned 0x1130000 [0055.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.459] GetProcessHeap () returned 0x1130000 [0055.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0055.460] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.460] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0055.460] CloseHandle (hObject=0x3c0) returned 0 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.460] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 52 [0055.700] GetProcessHeap () returned 0x1130000 [0055.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.700] GetProcessHeap () returned 0x1130000 [0055.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0055.700] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0055.700] GetProcessHeap () returned 0x1130000 [0055.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.700] ReadFile (in: hFile=0x3bc, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0055.700] GetProcessHeap () returned 0x1130000 [0055.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.700] GetProcessHeap () returned 0x1130000 [0055.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.700] GetProcessHeap () returned 0x1130000 [0055.700] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175b30 [0055.700] GetProcessHeap () returned 0x1130000 [0055.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175a40 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.701] GetProcessHeap () returned 0x1130000 [0055.701] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.702] GetProcessHeap () returned 0x1130000 [0055.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.702] GetProcessHeap () returned 0x1130000 [0055.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177aa8 [0055.703] GetProcessHeap () returned 0x1130000 [0055.703] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.703] GetProcessHeap () returned 0x1130000 [0055.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0055.703] GetProcessHeap () returned 0x1130000 [0055.703] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177aa8 | out: hHeap=0x1130000) returned 1 [0055.703] GetProcessHeap () returned 0x1130000 [0055.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0055.703] GetProcessHeap () returned 0x1130000 [0055.703] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0055.703] GetProcessHeap () returned 0x1130000 [0055.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0055.703] GetProcessHeap () returned 0x1130000 [0055.703] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0055.703] GetProcessHeap () returned 0x1130000 [0055.703] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.703] GetProcessHeap () returned 0x1130000 [0055.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.704] GetProcessHeap () returned 0x1130000 [0055.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.705] GetProcessHeap () returned 0x1130000 [0055.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0055.705] GetProcessHeap () returned 0x1130000 [0055.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.706] GetProcessHeap () returned 0x1130000 [0055.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0055.706] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.706] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0055.706] CloseHandle (hObject=0x3bc) returned 0 [0055.706] GetProcessHeap () returned 0x1130000 [0055.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.706] GetProcessHeap () returned 0x1130000 [0055.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.706] GetProcessHeap () returned 0x1130000 [0055.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.706] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 67 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0056.012] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36930e0 [0056.012] ReadFile (in: hFile=0x3bc, lpBuffer=0x36930e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x36930e0, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175888 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175a18 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.012] GetProcessHeap () returned 0x1130000 [0056.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.012] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.013] GetProcessHeap () returned 0x1130000 [0056.013] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.013] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e520 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e520 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.014] GetProcessHeap () returned 0x1130000 [0056.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.015] GetProcessHeap () returned 0x1130000 [0056.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0056.016] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.016] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0056.016] CloseHandle (hObject=0x3bc) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36930e0 | out: hHeap=0x1130000) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.016] GetProcessHeap () returned 0x1130000 [0056.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0056.016] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 87 [0056.247] GetProcessHeap () returned 0x1130000 [0056.247] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x117bf70 [0056.247] wnsprintfW (in: pszDest=0x117bf70, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\*") returned 19 [0056.247] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0056.247] wnsprintfW (in: pszDest=0x117bf70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\.") returned 19 [0056.247] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.247] wnsprintfW (in: pszDest=0x117bf70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\..") returned 20 [0056.247] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.247] wnsprintfW (in: pszDest=0x117bf70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 33 [0056.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.247] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d46e43, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d46e43, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3bc, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.247] wnsprintfW (in: pszDest=0x117bf70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lt-LT\\read_me.txt") returned 29 [0056.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\read_me.txt" (normalized: "c:\\boot\\lt-lt\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0056.247] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.248] GetProcessHeap () returned 0x1130000 [0056.248] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x117bf70 | out: hHeap=0x1130000) returned 1 [0056.248] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 52 [0056.248] GetProcessHeap () returned 0x1130000 [0056.248] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35f0050 | out: hHeap=0x1130000) returned 1 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0056.417] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.417] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11756d0 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175a68 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.417] GetProcessHeap () returned 0x1130000 [0056.417] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.417] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.418] GetProcessHeap () returned 0x1130000 [0056.418] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.419] GetProcessHeap () returned 0x1130000 [0056.419] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.419] GetProcessHeap () returned 0x1130000 [0056.420] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.420] GetProcessHeap () returned 0x1130000 [0056.420] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x38900a0 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0056.421] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.421] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0056.421] CloseHandle (hObject=0x3c0) returned 0 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0056.421] GetProcessHeap () returned 0x1130000 [0056.421] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0056.421] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 113 [0056.536] GetProcessHeap () returned 0x1130000 [0056.536] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.536] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Logs\\*") returned 13 [0056.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2a3dc4d, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.537] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\.") returned 13 [0056.537] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2a3dc4d, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.537] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\..") returned 14 [0056.537] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0056.537] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Application.evtx") returned 28 [0056.537] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.539] StrStrW (lpFirst="Application.evtx", lpSrch=".wctc") returned 0x0 [0056.539] GetProcessHeap () returned 0x1130000 [0056.539] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.540] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Application.evtx.wctc") returned 33 [0056.540] CloseHandle (hObject=0x3b0) returned 1 [0056.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Application.evtx.wctc" (normalized: "c:\\logs\\application.evtx.wctc")) returned 1 [0056.540] GetProcessHeap () returned 0x1130000 [0056.540] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.540] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 133 [0056.540] QueueUserWorkItem (Function=0x1294e00, Context=0x3b0, Flags=0x0) returned 1 [0056.541] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0056.541] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\HardwareEvents.evtx") returned 31 [0056.541] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.541] StrStrW (lpFirst="HardwareEvents.evtx", lpSrch=".wctc") returned 0x0 [0056.541] GetProcessHeap () returned 0x1130000 [0056.541] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.541] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\HardwareEvents.evtx.wctc") returned 36 [0056.542] CloseHandle (hObject=0x3a8) returned 1 [0056.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.wctc" (normalized: "c:\\logs\\hardwareevents.evtx.wctc")) returned 1 [0056.542] GetProcessHeap () returned 0x1130000 [0056.542] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.542] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 134 [0056.542] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.542] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0056.542] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Internet Explorer.evtx") returned 34 [0056.542] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.542] StrStrW (lpFirst="Internet Explorer.evtx", lpSrch=".wctc") returned 0x0 [0056.542] GetProcessHeap () returned 0x1130000 [0056.542] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.542] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Internet Explorer.evtx.wctc") returned 39 [0056.543] CloseHandle (hObject=0x3a8) returned 1 [0056.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.wctc" (normalized: "c:\\logs\\internet explorer.evtx.wctc")) returned 1 [0056.543] GetProcessHeap () returned 0x1130000 [0056.543] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.543] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 135 [0056.543] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.543] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0056.543] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Key Management Service.evtx") returned 39 [0056.543] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.543] StrStrW (lpFirst="Key Management Service.evtx", lpSrch=".wctc") returned 0x0 [0056.543] GetProcessHeap () returned 0x1130000 [0056.543] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.543] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Key Management Service.evtx.wctc") returned 44 [0056.543] CloseHandle (hObject=0x3a8) returned 1 [0056.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.wctc" (normalized: "c:\\logs\\key management service.evtx.wctc")) returned 1 [0056.544] GetProcessHeap () returned 0x1130000 [0056.544] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.544] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 136 [0056.544] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.544] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0056.544] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 59 [0056.544] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.544] StrStrW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.544] GetProcessHeap () returned 0x1130000 [0056.544] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.544] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.wctc") returned 64 [0056.544] CloseHandle (hObject=0x3a8) returned 1 [0056.544] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.wctc")) returned 1 [0056.545] GetProcessHeap () returned 0x1130000 [0056.545] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.545] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 137 [0056.545] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.545] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0056.545] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 90 [0056.545] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.546] StrStrW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch=".wctc") returned 0x0 [0056.546] GetProcessHeap () returned 0x1130000 [0056.546] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.546] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.wctc") returned 95 [0056.546] CloseHandle (hObject=0x3a8) returned 1 [0056.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.wctc")) returned 1 [0056.546] GetProcessHeap () returned 0x1130000 [0056.546] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.546] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 138 [0056.546] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.546] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0056.547] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 83 [0056.547] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.547] StrStrW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.547] GetProcessHeap () returned 0x1130000 [0056.547] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.547] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.wctc") returned 88 [0056.547] CloseHandle (hObject=0x3a8) returned 1 [0056.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.wctc")) returned 1 [0056.548] GetProcessHeap () returned 0x1130000 [0056.548] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.548] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 139 [0056.548] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.548] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0056.548] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 57 [0056.548] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.548] StrStrW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch=".wctc") returned 0x0 [0056.548] GetProcessHeap () returned 0x1130000 [0056.548] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.548] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.wctc") returned 62 [0056.548] CloseHandle (hObject=0x3a8) returned 1 [0056.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.wctc")) returned 1 [0056.549] GetProcessHeap () returned 0x1130000 [0056.549] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.549] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 140 [0056.549] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.549] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0056.549] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 60 [0056.549] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.549] StrStrW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch=".wctc") returned 0x0 [0056.549] GetProcessHeap () returned 0x1130000 [0056.549] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.549] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.wctc") returned 65 [0056.549] CloseHandle (hObject=0x3a8) returned 1 [0056.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.wctc")) returned 1 [0056.550] GetProcessHeap () returned 0x1130000 [0056.550] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.550] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 141 [0056.550] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.550] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0056.550] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 69 [0056.550] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.550] StrStrW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch=".wctc") returned 0x0 [0056.550] GetProcessHeap () returned 0x1130000 [0056.550] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.550] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.wctc") returned 74 [0056.550] CloseHandle (hObject=0x3a8) returned 1 [0056.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.wctc")) returned 1 [0056.551] GetProcessHeap () returned 0x1130000 [0056.551] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.551] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 142 [0056.551] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.551] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0056.551] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 68 [0056.551] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.551] StrStrW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch=".wctc") returned 0x0 [0056.551] GetProcessHeap () returned 0x1130000 [0056.551] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.551] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.wctc") returned 73 [0056.551] CloseHandle (hObject=0x3a8) returned 1 [0056.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.wctc")) returned 1 [0056.552] GetProcessHeap () returned 0x1130000 [0056.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.552] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 143 [0056.552] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.552] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0056.552] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 58 [0056.552] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.552] StrStrW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.552] GetProcessHeap () returned 0x1130000 [0056.552] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.552] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.wctc") returned 63 [0056.552] CloseHandle (hObject=0x3a8) returned 1 [0056.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.wctc")) returned 1 [0056.552] GetProcessHeap () returned 0x1130000 [0056.552] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.553] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 144 [0056.553] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.553] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0056.553] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 54 [0056.553] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.553] StrStrW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.553] GetProcessHeap () returned 0x1130000 [0056.553] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.553] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.wctc") returned 59 [0056.553] CloseHandle (hObject=0x3a8) returned 1 [0056.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.wctc")) returned 1 [0056.553] GetProcessHeap () returned 0x1130000 [0056.553] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.553] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 145 [0056.553] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.553] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0056.553] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 60 [0056.553] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.555] StrStrW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.555] GetProcessHeap () returned 0x1130000 [0056.555] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.555] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.wctc") returned 65 [0056.555] CloseHandle (hObject=0x3c0) returned 1 [0056.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.wctc")) returned 1 [0056.556] GetProcessHeap () returned 0x1130000 [0056.556] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.556] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 146 [0056.556] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.556] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0056.556] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 62 [0056.556] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.556] StrStrW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.556] GetProcessHeap () returned 0x1130000 [0056.556] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.556] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.wctc") returned 67 [0056.556] CloseHandle (hObject=0x3c0) returned 1 [0056.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.wctc")) returned 1 [0056.562] GetProcessHeap () returned 0x1130000 [0056.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.562] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 147 [0056.562] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.562] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0056.562] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 68 [0056.562] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.562] StrStrW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.562] GetProcessHeap () returned 0x1130000 [0056.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.562] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.wctc") returned 73 [0056.562] CloseHandle (hObject=0x3c0) returned 1 [0056.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.wctc")) returned 1 [0056.563] GetProcessHeap () returned 0x1130000 [0056.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.563] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 148 [0056.563] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.563] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0056.563] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 67 [0056.563] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.564] StrStrW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch=".wctc") returned 0x0 [0056.564] GetProcessHeap () returned 0x1130000 [0056.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.564] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.wctc") returned 72 [0056.564] CloseHandle (hObject=0x3c0) returned 1 [0056.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.wctc")) returned 1 [0056.565] GetProcessHeap () returned 0x1130000 [0056.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.565] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 149 [0056.565] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.565] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0056.565] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 61 [0056.565] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.565] StrStrW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.565] GetProcessHeap () returned 0x1130000 [0056.565] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.565] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.wctc") returned 66 [0056.565] CloseHandle (hObject=0x3c0) returned 1 [0056.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.wctc")) returned 1 [0056.566] GetProcessHeap () returned 0x1130000 [0056.566] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.566] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 150 [0056.566] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.566] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0056.566] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 76 [0056.566] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.566] StrStrW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.567] GetProcessHeap () returned 0x1130000 [0056.567] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.567] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.wctc") returned 81 [0056.567] CloseHandle (hObject=0x3c0) returned 1 [0056.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.wctc")) returned 1 [0056.567] GetProcessHeap () returned 0x1130000 [0056.567] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.567] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 151 [0056.567] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.567] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0056.567] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 59 [0056.567] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.568] StrStrW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.568] GetProcessHeap () returned 0x1130000 [0056.568] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.568] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.wctc") returned 64 [0056.568] CloseHandle (hObject=0x3c0) returned 1 [0056.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.wctc")) returned 1 [0056.568] GetProcessHeap () returned 0x1130000 [0056.568] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.568] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 152 [0056.568] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.568] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0056.569] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 61 [0056.569] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.569] StrStrW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.569] GetProcessHeap () returned 0x1130000 [0056.569] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.569] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.wctc") returned 66 [0056.569] CloseHandle (hObject=0x3c0) returned 1 [0056.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.wctc")) returned 1 [0056.569] GetProcessHeap () returned 0x1130000 [0056.569] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.569] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 153 [0056.569] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.569] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0056.569] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 75 [0056.569] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.570] StrStrW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.570] GetProcessHeap () returned 0x1130000 [0056.570] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.570] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.wctc") returned 80 [0056.570] CloseHandle (hObject=0x3c0) returned 1 [0056.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.wctc")) returned 1 [0056.570] GetProcessHeap () returned 0x1130000 [0056.570] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.570] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 154 [0056.570] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.570] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0056.570] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 61 [0056.570] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.571] StrStrW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch=".wctc") returned 0x0 [0056.571] GetProcessHeap () returned 0x1130000 [0056.571] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.571] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.wctc") returned 66 [0056.571] CloseHandle (hObject=0x3c0) returned 1 [0056.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.wctc")) returned 1 [0056.571] GetProcessHeap () returned 0x1130000 [0056.571] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.571] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 155 [0056.571] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.571] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0056.571] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 60 [0056.571] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.572] StrStrW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.572] GetProcessHeap () returned 0x1130000 [0056.572] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.572] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.wctc") returned 65 [0056.572] CloseHandle (hObject=0x3c0) returned 1 [0056.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.wctc")) returned 1 [0056.572] GetProcessHeap () returned 0x1130000 [0056.572] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.572] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 156 [0056.572] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.572] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0056.573] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 90 [0056.573] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.573] StrStrW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.573] GetProcessHeap () returned 0x1130000 [0056.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.573] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.wctc") returned 95 [0056.573] CloseHandle (hObject=0x3c0) returned 1 [0056.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.wctc")) returned 1 [0056.573] GetProcessHeap () returned 0x1130000 [0056.573] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.573] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 157 [0056.573] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.574] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0056.574] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 60 [0056.574] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.574] StrStrW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.574] GetProcessHeap () returned 0x1130000 [0056.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.574] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.wctc") returned 65 [0056.574] CloseHandle (hObject=0x3c0) returned 1 [0056.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.wctc")) returned 1 [0056.574] GetProcessHeap () returned 0x1130000 [0056.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.574] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 158 [0056.574] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.575] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0056.575] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 66 [0056.575] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.575] StrStrW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.575] GetProcessHeap () returned 0x1130000 [0056.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.575] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.wctc") returned 71 [0056.575] CloseHandle (hObject=0x3c0) returned 1 [0056.575] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.wctc")) returned 1 [0056.575] GetProcessHeap () returned 0x1130000 [0056.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.575] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 159 [0056.575] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.576] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0056.576] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 53 [0056.576] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.576] StrStrW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.576] GetProcessHeap () returned 0x1130000 [0056.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.576] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.wctc") returned 58 [0056.576] CloseHandle (hObject=0x3c0) returned 1 [0056.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.wctc")) returned 1 [0056.576] GetProcessHeap () returned 0x1130000 [0056.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.576] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 160 [0056.576] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.576] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0056.576] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 55 [0056.576] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.577] StrStrW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.577] GetProcessHeap () returned 0x1130000 [0056.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.577] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.wctc") returned 60 [0056.577] CloseHandle (hObject=0x3c0) returned 1 [0056.577] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.wctc")) returned 1 [0056.577] GetProcessHeap () returned 0x1130000 [0056.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.577] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 161 [0056.577] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.577] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0056.577] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 61 [0056.577] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.581] StrStrW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.581] GetProcessHeap () returned 0x1130000 [0056.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.581] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.wctc") returned 66 [0056.581] CloseHandle (hObject=0x3c0) returned 1 [0056.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.wctc")) returned 1 [0056.581] GetProcessHeap () returned 0x1130000 [0056.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.581] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 162 [0056.581] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0056.582] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 71 [0056.582] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.582] StrStrW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.582] GetProcessHeap () returned 0x1130000 [0056.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.582] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.wctc") returned 76 [0056.582] CloseHandle (hObject=0x3c0) returned 1 [0056.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.wctc")) returned 1 [0056.582] GetProcessHeap () returned 0x1130000 [0056.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.582] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 163 [0056.582] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0056.583] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 59 [0056.583] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.583] StrStrW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.583] GetProcessHeap () returned 0x1130000 [0056.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.583] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.wctc") returned 64 [0056.583] CloseHandle (hObject=0x3c0) returned 1 [0056.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.wctc")) returned 1 [0056.586] GetProcessHeap () returned 0x1130000 [0056.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.586] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 164 [0056.586] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.586] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0056.586] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 59 [0056.587] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.587] StrStrW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.587] GetProcessHeap () returned 0x1130000 [0056.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.587] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.wctc") returned 64 [0056.587] CloseHandle (hObject=0x3c0) returned 1 [0056.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.wctc")) returned 1 [0056.588] GetProcessHeap () returned 0x1130000 [0056.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.588] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 165 [0056.588] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.588] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0056.588] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 63 [0056.588] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.588] StrStrW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.588] GetProcessHeap () returned 0x1130000 [0056.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.588] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.wctc") returned 68 [0056.588] CloseHandle (hObject=0x3c0) returned 1 [0056.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.wctc")) returned 1 [0056.589] GetProcessHeap () returned 0x1130000 [0056.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.589] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 166 [0056.589] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.589] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0056.589] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 61 [0056.589] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.590] StrStrW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.590] GetProcessHeap () returned 0x1130000 [0056.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.590] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.wctc") returned 66 [0056.590] CloseHandle (hObject=0x3c0) returned 1 [0056.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.wctc")) returned 1 [0056.590] GetProcessHeap () returned 0x1130000 [0056.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.590] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 167 [0056.590] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.590] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0056.590] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 59 [0056.590] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.591] StrStrW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.591] GetProcessHeap () returned 0x1130000 [0056.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.591] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.wctc") returned 64 [0056.591] CloseHandle (hObject=0x3c0) returned 1 [0056.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.wctc")) returned 1 [0056.591] GetProcessHeap () returned 0x1130000 [0056.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.591] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 168 [0056.591] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.591] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0056.591] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 61 [0056.591] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.591] StrStrW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.592] GetProcessHeap () returned 0x1130000 [0056.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.592] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.wctc") returned 66 [0056.592] CloseHandle (hObject=0x3c0) returned 1 [0056.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.wctc")) returned 1 [0056.592] GetProcessHeap () returned 0x1130000 [0056.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.592] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 169 [0056.592] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.592] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0056.592] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 60 [0056.592] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.592] StrStrW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch=".wctc") returned 0x0 [0056.592] GetProcessHeap () returned 0x1130000 [0056.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.592] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.wctc") returned 65 [0056.592] CloseHandle (hObject=0x3c0) returned 1 [0056.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.wctc")) returned 1 [0056.593] GetProcessHeap () returned 0x1130000 [0056.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.593] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 170 [0056.593] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.593] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0056.593] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 68 [0056.593] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.593] StrStrW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.593] GetProcessHeap () returned 0x1130000 [0056.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.593] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.wctc") returned 73 [0056.593] CloseHandle (hObject=0x3c0) returned 1 [0056.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.wctc")) returned 1 [0056.594] GetProcessHeap () returned 0x1130000 [0056.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.594] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 171 [0056.594] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.594] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0056.594] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 65 [0056.594] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.594] StrStrW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.594] GetProcessHeap () returned 0x1130000 [0056.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.594] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.wctc") returned 70 [0056.594] CloseHandle (hObject=0x3c0) returned 1 [0056.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.wctc")) returned 1 [0056.595] GetProcessHeap () returned 0x1130000 [0056.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.595] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 172 [0056.595] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.595] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0056.595] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 63 [0056.595] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.595] StrStrW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.595] GetProcessHeap () returned 0x1130000 [0056.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.595] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.wctc") returned 68 [0056.595] CloseHandle (hObject=0x3c0) returned 1 [0056.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.wctc")) returned 1 [0056.596] GetProcessHeap () returned 0x1130000 [0056.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.596] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 173 [0056.596] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.596] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0056.596] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 54 [0056.596] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.597] StrStrW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch=".wctc") returned 0x0 [0056.597] GetProcessHeap () returned 0x1130000 [0056.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.597] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.wctc") returned 59 [0056.597] CloseHandle (hObject=0x3c0) returned 1 [0056.597] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.wctc")) returned 1 [0056.598] GetProcessHeap () returned 0x1130000 [0056.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.598] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 174 [0056.598] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.598] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0056.598] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 59 [0056.598] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.598] StrStrW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.598] GetProcessHeap () returned 0x1130000 [0056.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.598] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.wctc") returned 64 [0056.598] CloseHandle (hObject=0x3c0) returned 1 [0056.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.wctc")) returned 1 [0056.599] GetProcessHeap () returned 0x1130000 [0056.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.599] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 175 [0056.599] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.599] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0056.599] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 60 [0056.599] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.599] StrStrW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch=".wctc") returned 0x0 [0056.599] GetProcessHeap () returned 0x1130000 [0056.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.599] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.wctc") returned 65 [0056.599] CloseHandle (hObject=0x3c0) returned 1 [0056.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.wctc")) returned 1 [0056.600] GetProcessHeap () returned 0x1130000 [0056.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.600] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 176 [0056.600] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.600] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0056.600] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 54 [0056.600] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.600] StrStrW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.600] GetProcessHeap () returned 0x1130000 [0056.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.600] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.wctc") returned 59 [0056.600] CloseHandle (hObject=0x3c0) returned 1 [0056.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.wctc")) returned 1 [0056.601] GetProcessHeap () returned 0x1130000 [0056.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.601] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 177 [0056.601] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.601] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0056.601] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 45 [0056.601] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.601] StrStrW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.601] GetProcessHeap () returned 0x1130000 [0056.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.601] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.wctc") returned 50 [0056.601] CloseHandle (hObject=0x3c0) returned 1 [0056.601] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.wctc")) returned 1 [0056.602] GetProcessHeap () returned 0x1130000 [0056.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.602] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 178 [0056.602] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.602] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0056.602] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 51 [0056.602] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.602] StrStrW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.602] GetProcessHeap () returned 0x1130000 [0056.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.602] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.wctc") returned 56 [0056.602] CloseHandle (hObject=0x3c0) returned 1 [0056.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.wctc")) returned 1 [0056.602] GetProcessHeap () returned 0x1130000 [0056.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.603] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 179 [0056.603] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.603] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0056.603] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 52 [0056.603] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.603] StrStrW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.603] GetProcessHeap () returned 0x1130000 [0056.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.603] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.wctc") returned 57 [0056.603] CloseHandle (hObject=0x3c0) returned 1 [0056.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.wctc")) returned 1 [0056.603] GetProcessHeap () returned 0x1130000 [0056.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.603] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 180 [0056.603] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.603] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0056.603] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 62 [0056.603] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.604] StrStrW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.604] GetProcessHeap () returned 0x1130000 [0056.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.604] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.wctc") returned 67 [0056.604] CloseHandle (hObject=0x3c0) returned 1 [0056.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.wctc")) returned 1 [0056.604] GetProcessHeap () returned 0x1130000 [0056.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.604] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 181 [0056.604] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.604] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0056.604] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 52 [0056.604] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.606] StrStrW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.606] GetProcessHeap () returned 0x1130000 [0056.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.606] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.wctc") returned 57 [0056.606] CloseHandle (hObject=0x3c0) returned 1 [0056.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.wctc")) returned 1 [0056.606] GetProcessHeap () returned 0x1130000 [0056.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.606] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 182 [0056.606] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.606] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0056.606] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 44 [0056.606] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.607] StrStrW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch=".wctc") returned 0x0 [0056.607] GetProcessHeap () returned 0x1130000 [0056.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.607] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.wctc") returned 49 [0056.607] CloseHandle (hObject=0x3c0) returned 1 [0056.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.wctc")) returned 1 [0056.607] GetProcessHeap () returned 0x1130000 [0056.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.607] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 183 [0056.607] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.607] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0056.607] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 86 [0056.607] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.608] StrStrW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch=".wctc") returned 0x0 [0056.608] GetProcessHeap () returned 0x1130000 [0056.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.608] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.wctc") returned 91 [0056.608] CloseHandle (hObject=0x3c0) returned 1 [0056.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.wctc")) returned 1 [0056.609] GetProcessHeap () returned 0x1130000 [0056.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.609] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 184 [0056.609] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.609] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0056.609] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 58 [0056.609] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.609] StrStrW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.609] GetProcessHeap () returned 0x1130000 [0056.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.609] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.wctc") returned 63 [0056.609] CloseHandle (hObject=0x3c0) returned 1 [0056.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.wctc")) returned 1 [0056.610] GetProcessHeap () returned 0x1130000 [0056.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.610] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 185 [0056.610] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.610] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0056.610] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 76 [0056.610] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.610] StrStrW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.610] GetProcessHeap () returned 0x1130000 [0056.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.610] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.wctc") returned 81 [0056.610] CloseHandle (hObject=0x3c0) returned 1 [0056.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.wctc")) returned 1 [0056.611] GetProcessHeap () returned 0x1130000 [0056.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.611] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 186 [0056.611] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.611] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0056.611] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 53 [0056.611] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.611] StrStrW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch=".wctc") returned 0x0 [0056.611] GetProcessHeap () returned 0x1130000 [0056.611] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.611] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.wctc") returned 58 [0056.611] CloseHandle (hObject=0x3c0) returned 1 [0056.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.wctc")) returned 1 [0056.612] GetProcessHeap () returned 0x1130000 [0056.612] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.612] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 187 [0056.612] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.612] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0056.612] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 59 [0056.612] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.612] StrStrW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.612] GetProcessHeap () returned 0x1130000 [0056.612] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.612] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.wctc") returned 64 [0056.612] CloseHandle (hObject=0x3c0) returned 1 [0056.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.wctc")) returned 1 [0056.613] GetProcessHeap () returned 0x1130000 [0056.613] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.613] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 188 [0056.613] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.613] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0056.613] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 59 [0056.613] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.613] StrStrW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch=".wctc") returned 0x0 [0056.613] GetProcessHeap () returned 0x1130000 [0056.613] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.613] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.wctc") returned 64 [0056.613] CloseHandle (hObject=0x3c0) returned 1 [0056.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.wctc")) returned 1 [0056.614] GetProcessHeap () returned 0x1130000 [0056.614] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.614] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 189 [0056.614] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.614] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0056.614] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 58 [0056.614] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.614] StrStrW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.614] GetProcessHeap () returned 0x1130000 [0056.614] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.614] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.wctc") returned 63 [0056.614] CloseHandle (hObject=0x3c0) returned 1 [0056.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.wctc")) returned 1 [0056.615] GetProcessHeap () returned 0x1130000 [0056.615] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.615] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 190 [0056.615] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.615] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0056.615] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 58 [0056.615] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.615] StrStrW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch=".wctc") returned 0x0 [0056.615] GetProcessHeap () returned 0x1130000 [0056.615] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.615] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.wctc") returned 63 [0056.615] CloseHandle (hObject=0x3c0) returned 1 [0056.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.wctc")) returned 1 [0056.616] GetProcessHeap () returned 0x1130000 [0056.616] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.616] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 191 [0056.616] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.616] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0056.616] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 57 [0056.616] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.616] StrStrW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.616] GetProcessHeap () returned 0x1130000 [0056.616] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.616] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.wctc") returned 62 [0056.616] CloseHandle (hObject=0x3c0) returned 1 [0056.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.wctc")) returned 1 [0056.617] GetProcessHeap () returned 0x1130000 [0056.617] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.617] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 192 [0056.617] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.617] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0056.617] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 54 [0056.617] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.629] StrStrW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch=".wctc") returned 0x0 [0056.629] GetProcessHeap () returned 0x1130000 [0056.629] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.629] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.wctc") returned 59 [0056.629] CloseHandle (hObject=0x3c0) returned 1 [0056.629] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.wctc")) returned 1 [0056.630] GetProcessHeap () returned 0x1130000 [0056.630] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.630] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 194 [0056.630] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.630] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0056.630] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 51 [0056.630] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.631] StrStrW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch=".wctc") returned 0x0 [0056.631] GetProcessHeap () returned 0x1130000 [0056.631] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.631] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.wctc") returned 56 [0056.631] CloseHandle (hObject=0x3c0) returned 1 [0056.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.wctc")) returned 1 [0056.631] GetProcessHeap () returned 0x1130000 [0056.631] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.631] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 195 [0056.631] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.631] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0056.631] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 58 [0056.631] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.631] StrStrW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch=".wctc") returned 0x0 [0056.632] GetProcessHeap () returned 0x1130000 [0056.632] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.632] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.wctc") returned 63 [0056.632] CloseHandle (hObject=0x3c0) returned 1 [0056.632] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.wctc")) returned 1 [0056.632] GetProcessHeap () returned 0x1130000 [0056.632] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.632] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 196 [0056.632] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.632] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0056.632] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 57 [0056.632] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.632] StrStrW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.632] GetProcessHeap () returned 0x1130000 [0056.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.633] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.wctc") returned 62 [0056.633] CloseHandle (hObject=0x3c0) returned 1 [0056.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.wctc")) returned 1 [0056.633] GetProcessHeap () returned 0x1130000 [0056.633] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.633] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 197 [0056.633] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.633] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0056.633] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 54 [0056.633] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.633] StrStrW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch=".wctc") returned 0x0 [0056.633] GetProcessHeap () returned 0x1130000 [0056.633] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.633] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.wctc") returned 59 [0056.633] CloseHandle (hObject=0x3c0) returned 1 [0056.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.wctc")) returned 1 [0056.634] GetProcessHeap () returned 0x1130000 [0056.634] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.634] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 198 [0056.634] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.634] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0056.634] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 53 [0056.634] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.635] StrStrW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.635] GetProcessHeap () returned 0x1130000 [0056.635] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.635] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.wctc") returned 58 [0056.635] CloseHandle (hObject=0x3c0) returned 1 [0056.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.wctc")) returned 1 [0056.636] GetProcessHeap () returned 0x1130000 [0056.636] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.636] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 199 [0056.636] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.636] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0056.636] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 61 [0056.636] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.636] StrStrW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch=".wctc") returned 0x0 [0056.636] GetProcessHeap () returned 0x1130000 [0056.636] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.636] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.wctc") returned 66 [0056.636] CloseHandle (hObject=0x3c0) returned 1 [0056.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.wctc")) returned 1 [0056.637] GetProcessHeap () returned 0x1130000 [0056.637] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.637] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 200 [0056.637] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.637] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0056.637] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 78 [0056.637] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.638] StrStrW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.638] GetProcessHeap () returned 0x1130000 [0056.638] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.638] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.wctc") returned 83 [0056.638] CloseHandle (hObject=0x3c0) returned 1 [0056.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.wctc")) returned 1 [0056.638] GetProcessHeap () returned 0x1130000 [0056.638] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.638] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 201 [0056.638] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.638] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0056.638] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 84 [0056.638] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.639] StrStrW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.639] GetProcessHeap () returned 0x1130000 [0056.639] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.639] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.wctc") returned 89 [0056.639] CloseHandle (hObject=0x3c0) returned 1 [0056.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.wctc")) returned 1 [0056.639] GetProcessHeap () returned 0x1130000 [0056.639] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.639] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 202 [0056.639] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.639] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0056.639] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 82 [0056.639] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.640] StrStrW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch=".wctc") returned 0x0 [0056.640] GetProcessHeap () returned 0x1130000 [0056.640] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.640] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.wctc") returned 87 [0056.640] CloseHandle (hObject=0x3c0) returned 1 [0056.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.wctc")) returned 1 [0056.641] GetProcessHeap () returned 0x1130000 [0056.641] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.641] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 203 [0056.641] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.641] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0056.641] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 88 [0056.641] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.641] StrStrW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.641] GetProcessHeap () returned 0x1130000 [0056.641] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.641] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.wctc") returned 93 [0056.641] CloseHandle (hObject=0x3c0) returned 1 [0056.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.wctc")) returned 1 [0056.642] GetProcessHeap () returned 0x1130000 [0056.642] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.642] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 204 [0056.642] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.642] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0056.642] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 54 [0056.642] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.642] StrStrW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.642] GetProcessHeap () returned 0x1130000 [0056.642] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.642] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.wctc") returned 59 [0056.642] CloseHandle (hObject=0x3c0) returned 1 [0056.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.wctc")) returned 1 [0056.643] GetProcessHeap () returned 0x1130000 [0056.643] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.643] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 205 [0056.643] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.643] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0056.643] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 68 [0056.643] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.643] StrStrW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.643] GetProcessHeap () returned 0x1130000 [0056.643] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.643] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.wctc") returned 73 [0056.643] CloseHandle (hObject=0x3c0) returned 1 [0056.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.wctc")) returned 1 [0056.644] GetProcessHeap () returned 0x1130000 [0056.644] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.644] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 206 [0056.644] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.644] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0056.644] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 56 [0056.644] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.644] StrStrW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch=".wctc") returned 0x0 [0056.644] GetProcessHeap () returned 0x1130000 [0056.644] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.644] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.wctc") returned 61 [0056.644] CloseHandle (hObject=0x3c0) returned 1 [0056.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.wctc")) returned 1 [0056.645] GetProcessHeap () returned 0x1130000 [0056.645] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.645] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 207 [0056.645] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.645] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0056.645] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 57 [0056.645] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.645] StrStrW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch=".wctc") returned 0x0 [0056.645] GetProcessHeap () returned 0x1130000 [0056.645] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.645] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.wctc") returned 62 [0056.645] CloseHandle (hObject=0x3c0) returned 1 [0056.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.wctc")) returned 1 [0056.646] GetProcessHeap () returned 0x1130000 [0056.646] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.646] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 208 [0056.646] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.646] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0056.646] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 69 [0056.646] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.646] StrStrW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.646] GetProcessHeap () returned 0x1130000 [0056.646] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.647] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.wctc") returned 74 [0056.647] CloseHandle (hObject=0x3c0) returned 1 [0056.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.wctc")) returned 1 [0056.647] GetProcessHeap () returned 0x1130000 [0056.647] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.647] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 209 [0056.647] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.647] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0056.647] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 54 [0056.647] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.647] StrStrW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.647] GetProcessHeap () returned 0x1130000 [0056.647] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.648] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.wctc") returned 59 [0056.648] CloseHandle (hObject=0x3c0) returned 1 [0056.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.wctc")) returned 1 [0056.648] GetProcessHeap () returned 0x1130000 [0056.648] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.648] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 210 [0056.648] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.648] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0056.648] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 64 [0056.648] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.648] StrStrW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.648] GetProcessHeap () returned 0x1130000 [0056.648] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.648] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.wctc") returned 69 [0056.649] CloseHandle (hObject=0x3c0) returned 1 [0056.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.wctc")) returned 1 [0056.649] GetProcessHeap () returned 0x1130000 [0056.649] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.649] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 211 [0056.649] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.649] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0056.649] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 56 [0056.649] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.649] StrStrW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch=".wctc") returned 0x0 [0056.649] GetProcessHeap () returned 0x1130000 [0056.649] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.649] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.wctc") returned 61 [0056.649] CloseHandle (hObject=0x3c0) returned 1 [0056.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.wctc")) returned 1 [0056.650] GetProcessHeap () returned 0x1130000 [0056.650] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.650] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 212 [0056.650] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.650] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0056.650] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 94 [0056.650] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.650] StrStrW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch=".wctc") returned 0x0 [0056.650] GetProcessHeap () returned 0x1130000 [0056.650] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.650] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.wctc") returned 99 [0056.650] CloseHandle (hObject=0x3c0) returned 1 [0056.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.wctc")) returned 1 [0056.651] GetProcessHeap () returned 0x1130000 [0056.651] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.651] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 213 [0056.651] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.651] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0056.651] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 84 [0056.651] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.652] StrStrW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch=".wctc") returned 0x0 [0056.652] GetProcessHeap () returned 0x1130000 [0056.652] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.652] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.wctc") returned 89 [0056.652] CloseHandle (hObject=0x3c0) returned 1 [0056.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.wctc")) returned 1 [0056.653] GetProcessHeap () returned 0x1130000 [0056.653] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.653] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 214 [0056.653] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.653] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0056.653] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 69 [0056.653] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.653] StrStrW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch=".wctc") returned 0x0 [0056.653] GetProcessHeap () returned 0x1130000 [0056.653] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.653] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.wctc") returned 74 [0056.653] CloseHandle (hObject=0x3c0) returned 1 [0056.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.wctc")) returned 1 [0056.654] GetProcessHeap () returned 0x1130000 [0056.654] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.654] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 215 [0056.654] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.654] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0056.654] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 56 [0056.654] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.654] StrStrW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.654] GetProcessHeap () returned 0x1130000 [0056.654] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.654] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.wctc") returned 61 [0056.654] CloseHandle (hObject=0x3c0) returned 1 [0056.654] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.wctc")) returned 1 [0056.658] GetProcessHeap () returned 0x1130000 [0056.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.658] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 216 [0056.658] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.658] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0056.658] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 60 [0056.658] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.658] StrStrW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch=".wctc") returned 0x0 [0056.658] GetProcessHeap () returned 0x1130000 [0056.658] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.658] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.wctc") returned 65 [0056.658] CloseHandle (hObject=0x3c0) returned 1 [0056.658] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.wctc" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.wctc")) returned 1 [0056.658] GetProcessHeap () returned 0x1130000 [0056.659] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.659] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 217 [0056.659] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.659] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a3dc4d, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2a3dc4d, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a641a5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.659] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\read_me.txt") returned 23 [0056.659] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\read_me.txt" (normalized: "c:\\logs\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.659] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.659] GetProcessHeap () returned 0x1130000 [0056.659] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.659] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Security.evtx.wctc") returned 30 [0056.659] CloseHandle (hObject=0x3c0) returned 1 [0056.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Security.evtx.wctc" (normalized: "c:\\logs\\security.evtx.wctc")) returned 1 [0056.659] GetProcessHeap () returned 0x1130000 [0056.659] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.659] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 218 [0056.660] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.660] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0056.660] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Setup.evtx") returned 22 [0056.660] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.660] StrStrW (lpFirst="Setup.evtx", lpSrch=".wctc") returned 0x0 [0056.660] GetProcessHeap () returned 0x1130000 [0056.660] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.660] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Setup.evtx.wctc") returned 27 [0056.660] CloseHandle (hObject=0x3c0) returned 1 [0056.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Setup.evtx.wctc" (normalized: "c:\\logs\\setup.evtx.wctc")) returned 1 [0056.660] GetProcessHeap () returned 0x1130000 [0056.660] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.660] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 219 [0056.660] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.660] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0056.660] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\System.evtx") returned 23 [0056.660] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.661] StrStrW (lpFirst="System.evtx", lpSrch=".wctc") returned 0x0 [0056.661] GetProcessHeap () returned 0x1130000 [0056.661] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.661] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\System.evtx.wctc") returned 28 [0056.661] CloseHandle (hObject=0x3c0) returned 1 [0056.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\System.evtx.wctc" (normalized: "c:\\logs\\system.evtx.wctc")) returned 1 [0056.662] GetProcessHeap () returned 0x1130000 [0056.662] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.662] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 220 [0056.662] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.662] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0056.662] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Logs\\Windows PowerShell.evtx") returned 35 [0056.662] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.662] StrStrW (lpFirst="Windows PowerShell.evtx", lpSrch=".wctc") returned 0x0 [0056.662] GetProcessHeap () returned 0x1130000 [0056.662] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.662] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.wctc") returned 40 [0056.662] CloseHandle (hObject=0x3c0) returned 1 [0056.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.wctc" (normalized: "c:\\logs\\windows powershell.evtx.wctc")) returned 1 [0056.662] GetProcessHeap () returned 0x1130000 [0056.662] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.663] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 221 [0056.663] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.663] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="windows powershell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0056.663] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.663] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Logs\\read_me.txt") returned 23 [0056.663] GetProcessHeap () returned 0x1130000 [0056.663] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.663] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 79 [0056.663] GetProcessHeap () returned 0x1130000 [0056.663] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3820068 | out: hHeap=0x1130000) returned 1 [0056.666] GetProcessHeap () returned 0x1130000 [0056.666] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.680] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Recovery\\Logs\\*") returned 22 [0056.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\Logs\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0xf2a89fdd, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.680] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\Logs\\.") returned 22 [0056.680] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0xf2a89fdd, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.680] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\Logs\\..") returned 23 [0056.680] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2a89fdd, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2a89fdd, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a89fdd, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.680] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\Logs\\read_me.txt") returned 32 [0056.680] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\Logs\\read_me.txt" (normalized: "c:\\recovery\\logs\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.680] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.681] GetProcessHeap () returned 0x1130000 [0056.681] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.681] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 81 [0056.681] GetProcessHeap () returned 0x1130000 [0056.681] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdc30 | out: hHeap=0x1130000) returned 1 [0056.681] GetProcessHeap () returned 0x1130000 [0056.681] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.681] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\*") returned 14 [0056.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xf2a1793c, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a1793c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.681] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\.") returned 14 [0056.681] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xf2a1793c, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a1793c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c0, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.681] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\..") returned 15 [0056.682] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x77c08fcf, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0056.682] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\All Users") returned 22 [0056.682] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x77c08fcf, cFileName="Default", cAlternateFileName="")) returned 1 [0056.682] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default") returned 20 [0056.682] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0056.682] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default User") returned 25 [0056.682] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf2cc6580, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2cc6580, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0056.682] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated") returned 29 [0056.682] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.682] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\desktop.ini") returned 24 [0056.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.682] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0056.682] GetProcessHeap () returned 0x1130000 [0056.682] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.682] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 82 [0056.682] GetProcessHeap () returned 0x1130000 [0056.682] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3960108 | out: hHeap=0x1130000) returned 1 [0056.683] GetProcessHeap () returned 0x1130000 [0056.683] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.683] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\*") returned 22 [0056.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2c2d9bd, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\.") returned 22 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2c2d9bd, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\..") returned 23 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="AppData", cAlternateFileName="")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData") returned 28 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data") returned 37 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Cookies", cAlternateFileName="")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies") returned 28 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Desktop", cAlternateFileName="")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop") returned 28 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents") returned 30 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads") returned 30 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites") returned 30 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Links", cAlternateFileName="")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links") returned 26 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings") returned 35 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b48e6e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Music", cAlternateFileName="")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music") returned 26 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents") returned 33 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="NetHood", cAlternateFileName="")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood") returned 28 [0056.684] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7a4c27fa, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0056.684] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT") returned 31 [0056.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.686] StrStrW (lpFirst="NTUSER.DAT", lpSrch=".wctc") returned 0x0 [0056.688] GetProcessHeap () returned 0x1130000 [0056.688] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.688] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 83 [0056.688] GetProcessHeap () returned 0x1130000 [0056.688] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3980118 | out: hHeap=0x1130000) returned 1 [0056.690] GetProcessHeap () returned 0x1130000 [0056.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.690] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data\\*") returned 39 [0056.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Videos", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.690] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data\\read_me.txt") returned 49 [0056.690] GetProcessHeap () returned 0x1130000 [0056.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.690] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 84 [0056.690] GetProcessHeap () returned 0x1130000 [0056.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39a0128 | out: hHeap=0x1130000) returned 1 [0056.692] GetProcessHeap () returned 0x1130000 [0056.692] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x39a0128 [0056.693] wnsprintfW (in: pszDest=0x39a0128, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies\\*") returned 30 [0056.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Videos", cAlternateFileName="Ά翾塚έ\x18")) returned 0xffffffff [0056.693] wnsprintfW (in: pszDest=0x39a0128, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies\\read_me.txt") returned 40 [0056.693] GetProcessHeap () returned 0x1130000 [0056.693] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39a0128 | out: hHeap=0x1130000) returned 1 [0056.693] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 85 [0056.693] GetProcessHeap () returned 0x1130000 [0056.693] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39b0130 | out: hHeap=0x1130000) returned 1 [0056.693] GetProcessHeap () returned 0x1130000 [0056.693] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.694] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\*") returned 30 [0056.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2ad6582, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.694] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\.") returned 30 [0056.694] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2ad6582, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.694] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\..") returned 31 [0056.694] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ad6582, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2ad6582, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2ad6582, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.694] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\read_me.txt") returned 40 [0056.695] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\read_me.txt" (normalized: "c:\\users\\default\\desktop\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.695] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.695] GetProcessHeap () returned 0x1130000 [0056.695] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.695] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 86 [0056.695] GetProcessHeap () returned 0x1130000 [0056.695] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39c0138 | out: hHeap=0x1130000) returned 1 [0056.695] GetProcessHeap () returned 0x1130000 [0056.695] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3850080 [0056.695] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\*") returned 32 [0056.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.695] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\.") returned 32 [0056.695] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.695] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\..") returned 33 [0056.695] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0056.695] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music") returned 39 [0056.696] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0056.696] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures") returned 42 [0056.696] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0056.696] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos") returned 40 [0056.696] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.696] wnsprintfW (in: pszDest=0x3850080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\read_me.txt") returned 42 [0056.696] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\read_me.txt" (normalized: "c:\\users\\default\\documents\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.696] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.696] GetProcessHeap () returned 0x1130000 [0056.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.696] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 87 [0056.696] GetProcessHeap () returned 0x1130000 [0056.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3be0048 | out: hHeap=0x1130000) returned 1 [0056.696] GetProcessHeap () returned 0x1130000 [0056.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3be0048 [0056.696] wnsprintfW (in: pszDest=0x3be0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\*") returned 41 [0056.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.696] wnsprintfW (in: pszDest=0x3be0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\read_me.txt") returned 51 [0056.696] GetProcessHeap () returned 0x1130000 [0056.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3be0048 | out: hHeap=0x1130000) returned 1 [0056.696] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 88 [0056.696] GetProcessHeap () returned 0x1130000 [0056.696] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c00058 | out: hHeap=0x1130000) returned 1 [0056.696] GetProcessHeap () returned 0x1130000 [0056.696] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c00058 [0056.696] wnsprintfW (in: pszDest=0x3c00058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\*") returned 44 [0056.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ\x18")) returned 0xffffffff [0056.697] wnsprintfW (in: pszDest=0x3c00058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\read_me.txt") returned 54 [0056.697] GetProcessHeap () returned 0x1130000 [0056.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c00058 | out: hHeap=0x1130000) returned 1 [0056.697] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 89 [0056.697] GetProcessHeap () returned 0x1130000 [0056.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3860088 | out: hHeap=0x1130000) returned 1 [0056.697] GetProcessHeap () returned 0x1130000 [0056.697] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c00058 [0056.697] wnsprintfW (in: pszDest=0x3c00058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\*") returned 42 [0056.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.697] wnsprintfW (in: pszDest=0x3c00058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\read_me.txt") returned 52 [0056.697] GetProcessHeap () returned 0x1130000 [0056.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c00058 | out: hHeap=0x1130000) returned 1 [0056.697] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 90 [0056.697] GetProcessHeap () returned 0x1130000 [0056.697] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0056.700] GetProcessHeap () returned 0x1130000 [0056.700] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3c00058 [0056.700] wnsprintfW (in: pszDest=0x3c00058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\*") returned 32 [0056.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.700] wnsprintfW (in: pszDest=0x3c00058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\.") returned 32 [0056.700] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.700] wnsprintfW (in: pszDest=0x3c00058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\..") returned 33 [0056.700] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bbb328, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2bbb328, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.700] wnsprintfW (in: pszDest=0x3c00058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\read_me.txt") returned 42 [0056.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\read_me.txt" (normalized: "c:\\users\\default\\downloads\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.700] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.700] GetProcessHeap () returned 0x1130000 [0056.700] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c00058 | out: hHeap=0x1130000) returned 1 [0056.702] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 91 [0056.702] GetProcessHeap () returned 0x1130000 [0056.702] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3bf0050 | out: hHeap=0x1130000) returned 1 [0056.702] GetProcessHeap () returned 0x1130000 [0056.702] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.703] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\*") returned 32 [0056.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.703] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\.") returned 32 [0056.703] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.703] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\..") returned 33 [0056.703] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bbb328, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2bbb328, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.704] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\read_me.txt") returned 42 [0056.704] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\read_me.txt" (normalized: "c:\\users\\default\\favorites\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.704] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.704] GetProcessHeap () returned 0x1130000 [0056.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.704] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 92 [0056.704] GetProcessHeap () returned 0x1130000 [0056.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c10060 | out: hHeap=0x1130000) returned 1 [0056.704] GetProcessHeap () returned 0x1130000 [0056.704] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.704] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\*") returned 28 [0056.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Links\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.704] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\.") returned 28 [0056.704] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.704] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\..") returned 29 [0056.704] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bbb328, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2bbb328, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.704] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\read_me.txt") returned 38 [0056.704] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\read_me.txt" (normalized: "c:\\users\\default\\links\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.704] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.704] GetProcessHeap () returned 0x1130000 [0056.704] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.704] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 93 [0056.705] GetProcessHeap () returned 0x1130000 [0056.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c20068 | out: hHeap=0x1130000) returned 1 [0056.705] GetProcessHeap () returned 0x1130000 [0056.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.705] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings\\*") returned 37 [0056.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bbb328, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2bbb328, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2bbb328, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.705] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings\\read_me.txt") returned 47 [0056.705] GetProcessHeap () returned 0x1130000 [0056.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.705] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 94 [0056.705] GetProcessHeap () returned 0x1130000 [0056.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c30070 | out: hHeap=0x1130000) returned 1 [0056.705] GetProcessHeap () returned 0x1130000 [0056.705] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.705] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\*") returned 28 [0056.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Music\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b48e6e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0056.705] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\.") returned 28 [0056.705] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b48e6e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.705] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\..") returned 29 [0056.705] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b48e6e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.705] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\read_me.txt") returned 38 [0056.705] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Music\\read_me.txt" (normalized: "c:\\users\\default\\music\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.705] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.705] GetProcessHeap () returned 0x1130000 [0056.705] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.705] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 95 [0056.705] GetProcessHeap () returned 0x1130000 [0056.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c40078 | out: hHeap=0x1130000) returned 1 [0056.706] GetProcessHeap () returned 0x1130000 [0056.706] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.706] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents\\*") returned 35 [0056.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b48e6e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.706] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents\\read_me.txt") returned 45 [0056.706] GetProcessHeap () returned 0x1130000 [0056.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.706] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 96 [0056.706] GetProcessHeap () returned 0x1130000 [0056.706] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c50080 | out: hHeap=0x1130000) returned 1 [0056.708] GetProcessHeap () returned 0x1130000 [0056.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.708] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood\\*") returned 30 [0056.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b48e6e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b48e6e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ\x18")) returned 0xffffffff [0056.708] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood\\read_me.txt") returned 40 [0056.708] GetProcessHeap () returned 0x1130000 [0056.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.708] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 97 [0056.708] GetProcessHeap () returned 0x1130000 [0056.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c60088 | out: hHeap=0x1130000) returned 1 [0056.709] GetProcessHeap () returned 0x1130000 [0056.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.709] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\*") returned 31 [0056.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0056.710] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\.") returned 31 [0056.710] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.710] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\..") returned 32 [0056.710] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.710] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\read_me.txt") returned 41 [0056.710] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\read_me.txt" (normalized: "c:\\users\\default\\pictures\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.710] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.710] GetProcessHeap () returned 0x1130000 [0056.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.710] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 98 [0056.710] GetProcessHeap () returned 0x1130000 [0056.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c70090 | out: hHeap=0x1130000) returned 1 [0056.710] GetProcessHeap () returned 0x1130000 [0056.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.710] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood\\*") returned 32 [0056.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ\x18")) returned 0xffffffff [0056.710] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood\\read_me.txt") returned 42 [0056.710] GetProcessHeap () returned 0x1130000 [0056.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.710] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 99 [0056.710] GetProcessHeap () returned 0x1130000 [0056.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c80098 | out: hHeap=0x1130000) returned 1 [0056.710] GetProcessHeap () returned 0x1130000 [0056.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.710] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent\\*") returned 29 [0056.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Recent\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.711] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent\\read_me.txt") returned 39 [0056.711] GetProcessHeap () returned 0x1130000 [0056.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.711] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 100 [0056.711] GetProcessHeap () returned 0x1130000 [0056.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3c900a0 | out: hHeap=0x1130000) returned 1 [0056.711] GetProcessHeap () returned 0x1130000 [0056.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.711] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\*") returned 34 [0056.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2c07738, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.711] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\.") returned 34 [0056.711] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2c07738, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.711] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\..") returned 35 [0056.711] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c07738, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2c07738, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2c07738, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.711] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\read_me.txt") returned 44 [0056.711] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\read_me.txt" (normalized: "c:\\users\\default\\saved games\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.711] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.711] GetProcessHeap () returned 0x1130000 [0056.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.711] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 101 [0056.711] GetProcessHeap () returned 0x1130000 [0056.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ca00a8 | out: hHeap=0x1130000) returned 1 [0056.711] GetProcessHeap () returned 0x1130000 [0056.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.711] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo\\*") returned 29 [0056.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c07738, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2c07738, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2c07738, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.712] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo\\read_me.txt") returned 39 [0056.712] GetProcessHeap () returned 0x1130000 [0056.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.712] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 102 [0056.712] GetProcessHeap () returned 0x1130000 [0056.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cb00b0 | out: hHeap=0x1130000) returned 1 [0056.834] GetProcessHeap () returned 0x1130000 [0056.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.834] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Templates\\*") returned 32 [0056.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Templates\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c07738, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2c07738, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2c07738, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ\x18")) returned 0xffffffff [0056.834] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Templates\\read_me.txt") returned 42 [0056.834] GetProcessHeap () returned 0x1130000 [0056.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.834] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 104 [0056.834] GetProcessHeap () returned 0x1130000 [0056.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cd00c0 | out: hHeap=0x1130000) returned 1 [0056.836] GetProcessHeap () returned 0x1130000 [0056.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.836] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\*") returned 29 [0056.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.836] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\.") returned 29 [0056.836] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.836] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\..") returned 30 [0056.836] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.836] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\read_me.txt") returned 39 [0056.836] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\read_me.txt" (normalized: "c:\\users\\default\\videos\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.836] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.836] GetProcessHeap () returned 0x1130000 [0056.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.836] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 105 [0056.836] GetProcessHeap () returned 0x1130000 [0056.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ce00c8 | out: hHeap=0x1130000) returned 1 [0056.836] GetProcessHeap () returned 0x1130000 [0056.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.837] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default User\\*") returned 27 [0056.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default User\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b952fa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2b952fa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2b952fa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ\x18")) returned 0xffffffff [0056.837] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default User\\read_me.txt") returned 37 [0056.837] GetProcessHeap () returned 0x1130000 [0056.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.837] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 106 [0056.837] GetProcessHeap () returned 0x1130000 [0056.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3990120 | out: hHeap=0x1130000) returned 1 [0056.837] GetProcessHeap () returned 0x1130000 [0056.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.837] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\*") returned 31 [0056.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default.migrated\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf2cc6580, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2cc6580, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0056.838] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\.") returned 31 [0056.838] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf2cc6580, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2cc6580, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.838] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\..") returned 32 [0056.838] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="AppData", cAlternateFileName="")) returned 1 [0056.838] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\AppData") returned 37 [0056.838] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0056.838] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\Documents") returned 39 [0056.838] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2cc6580, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2cc6580, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d12913, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.838] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default.migrated\\read_me.txt") returned 41 [0056.838] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default.migrated\\read_me.txt" (normalized: "c:\\users\\default.migrated\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.838] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.838] GetProcessHeap () returned 0x1130000 [0056.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.838] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 107 [0056.838] GetProcessHeap () returned 0x1130000 [0056.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cf00d0 | out: hHeap=0x1130000) returned 1 [0056.869] GetProcessHeap () returned 0x1130000 [0056.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.885] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\*") returned 21 [0056.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.885] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\.") returned 21 [0056.885] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.886] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\..") returned 22 [0056.886] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="AppData", cAlternateFileName="")) returned 1 [0056.886] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\AppData") returned 27 [0056.886] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0056.886] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Application Data") returned 36 [0056.886] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Contacts", cAlternateFileName="")) returned 1 [0056.886] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts") returned 28 [0056.886] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Cookies", cAlternateFileName="")) returned 1 [0056.886] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Cookies") returned 27 [0056.887] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Desktop", cAlternateFileName="")) returned 1 [0056.887] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop") returned 27 [0056.887] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd5714832, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xd5714832, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0056.887] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents") returned 29 [0056.887] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0056.887] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Downloads") returned 29 [0056.887] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0056.887] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites") returned 29 [0056.887] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Links", cAlternateFileName="")) returned 1 [0056.887] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links") returned 25 [0056.887] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0056.887] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Local Settings") returned 34 [0056.887] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Music", cAlternateFileName="")) returned 1 [0056.887] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music") returned 25 [0056.887] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0056.887] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\My Documents") returned 32 [0056.888] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="NetHood", cAlternateFileName="")) returned 1 [0056.888] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NetHood") returned 27 [0056.888] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0056.888] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NTUSER.DAT") returned 30 [0056.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.888] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0056.888] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned 35 [0056.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.888] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0056.888] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\ntuser.dat.LOG2") returned 35 [0056.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.888] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0056.888] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 75 [0056.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.888] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0056.889] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 112 [0056.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.889] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0056.889] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 112 [0056.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.889] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0056.889] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\ntuser.ini") returned 30 [0056.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.890] StrStrW (lpFirst="ntuser.ini", lpSrch=".wctc") returned 0x0 [0056.890] GetProcessHeap () returned 0x1130000 [0056.890] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.891] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\ntuser.ini.wctc") returned 35 [0056.891] CloseHandle (hObject=0x3c0) returned 1 [0056.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\ntuser.ini.wctc" (normalized: "c:\\users\\fd1hvy\\ntuser.ini.wctc")) returned 1 [0056.892] GetProcessHeap () returned 0x1130000 [0056.892] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.892] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 222 [0056.892] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.892] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0056.892] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\OneDrive") returned 28 [0056.892] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d5efd9, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d5efd9, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Pictures", cAlternateFileName="")) returned 1 [0056.892] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures") returned 28 [0056.892] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0056.892] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\PrintHood") returned 29 [0056.892] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf328b3f5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.892] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\read_me.txt") returned 31 [0056.892] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.892] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.893] GetProcessHeap () returned 0x1130000 [0056.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.893] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 108 [0056.893] GetProcessHeap () returned 0x1130000 [0056.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d000d8 | out: hHeap=0x1130000) returned 1 [0056.893] GetProcessHeap () returned 0x1130000 [0056.893] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.893] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Application Data\\*") returned 38 [0056.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2e43d66, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Videos", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.893] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Application Data\\read_me.txt") returned 48 [0056.893] GetProcessHeap () returned 0x1130000 [0056.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.893] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 109 [0056.893] GetProcessHeap () returned 0x1130000 [0056.893] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d200e8 | out: hHeap=0x1130000) returned 1 [0056.894] GetProcessHeap () returned 0x1130000 [0056.894] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3d200e8 [0056.894] wnsprintfW (in: pszDest=0x3d200e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\*") returned 30 [0056.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2d12913, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0056.894] wnsprintfW (in: pszDest=0x3d200e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\.") returned 30 [0056.894] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2d12913, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.894] wnsprintfW (in: pszDest=0x3d200e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\..") returned 31 [0056.894] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.894] wnsprintfW (in: pszDest=0x3d200e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\desktop.ini") returned 40 [0056.894] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.894] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0056.894] GetProcessHeap () returned 0x1130000 [0056.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d200e8 | out: hHeap=0x1130000) returned 1 [0056.894] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 110 [0056.894] GetProcessHeap () returned 0x1130000 [0056.894] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d300f0 | out: hHeap=0x1130000) returned 1 [0056.897] GetProcessHeap () returned 0x1130000 [0056.897] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.898] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Cookies\\*") returned 29 [0056.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d12913, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2d12913, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d12913, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0056.898] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Cookies\\read_me.txt") returned 39 [0056.898] GetProcessHeap () returned 0x1130000 [0056.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.898] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 111 [0056.898] GetProcessHeap () returned 0x1130000 [0056.898] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d400f8 | out: hHeap=0x1130000) returned 1 [0056.898] GetProcessHeap () returned 0x1130000 [0056.898] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.898] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\*") returned 29 [0056.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0056.898] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\.") returned 29 [0056.899] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.899] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\..") returned 30 [0056.899] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x134e6990, ftCreationTime.dwHighDateTime=0x1d4d521, ftLastAccessTime.dwLowDateTime=0x26858590, ftLastAccessTime.dwHighDateTime=0x1d4ceee, ftLastWriteTime.dwLowDateTime=0x26858590, ftLastWriteTime.dwHighDateTime=0x1d4ceee, nFileSizeHigh=0x0, nFileSizeLow=0x7804, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="-xYY0z.ppt", cAlternateFileName="")) returned 1 [0056.899] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\-xYY0z.ppt") returned 38 [0056.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\-xYY0z.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\-xyy0z.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.899] StrStrW (lpFirst="-xYY0z.ppt", lpSrch=".wctc") returned 0x0 [0056.899] GetProcessHeap () returned 0x1130000 [0056.899] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.900] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\-xYY0z.ppt.wctc") returned 43 [0056.900] CloseHandle (hObject=0x3c0) returned 1 [0056.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\-xYY0z.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\-xyy0z.ppt"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\-xYY0z.ppt.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\-xyy0z.ppt.wctc")) returned 1 [0056.901] GetProcessHeap () returned 0x1130000 [0056.901] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.901] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 223 [0056.901] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.901] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ec4a10, ftCreationTime.dwHighDateTime=0x1d4d42b, ftLastAccessTime.dwLowDateTime=0xd5172230, ftLastAccessTime.dwHighDateTime=0x1d4cd5e, ftLastWriteTime.dwLowDateTime=0xd5172230, ftLastWriteTime.dwHighDateTime=0x1d4cd5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb34, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="0EN_neRNTBxb92nCUV.mp4", cAlternateFileName="0EN_NE~1.MP4")) returned 1 [0056.901] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0EN_neRNTBxb92nCUV.mp4") returned 50 [0056.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0EN_neRNTBxb92nCUV.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\0en_nerntbxb92ncuv.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.901] StrStrW (lpFirst="0EN_neRNTBxb92nCUV.mp4", lpSrch=".wctc") returned 0x0 [0056.901] GetProcessHeap () returned 0x1130000 [0056.901] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.901] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0EN_neRNTBxb92nCUV.mp4.wctc") returned 55 [0056.901] CloseHandle (hObject=0x3c0) returned 1 [0056.902] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0EN_neRNTBxb92nCUV.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\0en_nerntbxb92ncuv.mp4"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0EN_neRNTBxb92nCUV.mp4.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\0en_nerntbxb92ncuv.mp4.wctc")) returned 1 [0056.902] GetProcessHeap () returned 0x1130000 [0056.902] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.902] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 224 [0056.902] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.902] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b1d4d0, ftCreationTime.dwHighDateTime=0x1d4ce65, ftLastAccessTime.dwLowDateTime=0xe2f95400, ftLastAccessTime.dwHighDateTime=0x1d4d032, ftLastWriteTime.dwLowDateTime=0xe2f95400, ftLastWriteTime.dwHighDateTime=0x1d4d032, nFileSizeHigh=0x0, nFileSizeLow=0xb7be, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="0kYErnuNXsN-UIs9H2I.mkv", cAlternateFileName="0KYERN~1.MKV")) returned 1 [0056.902] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0kYErnuNXsN-UIs9H2I.mkv") returned 51 [0056.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0kYErnuNXsN-UIs9H2I.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\0kyernunxsn-uis9h2i.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.902] StrStrW (lpFirst="0kYErnuNXsN-UIs9H2I.mkv", lpSrch=".wctc") returned 0x0 [0056.902] GetProcessHeap () returned 0x1130000 [0056.902] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.902] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0kYErnuNXsN-UIs9H2I.mkv.wctc") returned 56 [0056.903] CloseHandle (hObject=0x3c0) returned 1 [0056.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0kYErnuNXsN-UIs9H2I.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\0kyernunxsn-uis9h2i.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\0kYErnuNXsN-UIs9H2I.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\0kyernunxsn-uis9h2i.mkv.wctc")) returned 1 [0056.903] GetProcessHeap () returned 0x1130000 [0056.903] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.903] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 225 [0056.903] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.903] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef1e8f0, ftCreationTime.dwHighDateTime=0x1d4d37b, ftLastAccessTime.dwLowDateTime=0x6cffbd50, ftLastAccessTime.dwHighDateTime=0x1d4cf80, ftLastWriteTime.dwLowDateTime=0x6cffbd50, ftLastWriteTime.dwHighDateTime=0x1d4cf80, nFileSizeHigh=0x0, nFileSizeLow=0x8d8, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="1LyFNLFLMMM k.mkv", cAlternateFileName="1LYFNL~1.MKV")) returned 1 [0056.903] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\1LyFNLFLMMM k.mkv") returned 45 [0056.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\1LyFNLFLMMM k.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\1lyfnlflmmm k.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.903] StrStrW (lpFirst="1LyFNLFLMMM k.mkv", lpSrch=".wctc") returned 0x0 [0056.903] GetProcessHeap () returned 0x1130000 [0056.903] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.903] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\1LyFNLFLMMM k.mkv.wctc") returned 50 [0056.903] CloseHandle (hObject=0x3c0) returned 1 [0056.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\1LyFNLFLMMM k.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\1lyfnlflmmm k.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\1LyFNLFLMMM k.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\1lyfnlflmmm k.mkv.wctc")) returned 1 [0056.904] GetProcessHeap () returned 0x1130000 [0056.904] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.904] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 226 [0056.904] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.904] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb8e6b0, ftCreationTime.dwHighDateTime=0x1d4d39b, ftLastAccessTime.dwLowDateTime=0x3b8a5ce0, ftLastAccessTime.dwHighDateTime=0x1d4cdc2, ftLastWriteTime.dwLowDateTime=0x3b8a5ce0, ftLastWriteTime.dwHighDateTime=0x1d4cdc2, nFileSizeHigh=0x0, nFileSizeLow=0x6779, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="2AyeNwkWu8g.swf", cAlternateFileName="2AYENW~1.SWF")) returned 1 [0056.904] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2AyeNwkWu8g.swf") returned 43 [0056.904] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2AyeNwkWu8g.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\2ayenwkwu8g.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.904] StrStrW (lpFirst="2AyeNwkWu8g.swf", lpSrch=".wctc") returned 0x0 [0056.904] GetProcessHeap () returned 0x1130000 [0056.904] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.904] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2AyeNwkWu8g.swf.wctc") returned 48 [0056.904] CloseHandle (hObject=0x3c0) returned 1 [0056.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2AyeNwkWu8g.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\2ayenwkwu8g.swf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2AyeNwkWu8g.swf.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\2ayenwkwu8g.swf.wctc")) returned 1 [0056.905] GetProcessHeap () returned 0x1130000 [0056.905] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.905] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 227 [0056.905] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.905] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccad250, ftCreationTime.dwHighDateTime=0x1d4cabf, ftLastAccessTime.dwLowDateTime=0x3bbb9250, ftLastAccessTime.dwHighDateTime=0x1d4cb8e, ftLastWriteTime.dwLowDateTime=0x3bbb9250, ftLastWriteTime.dwHighDateTime=0x1d4cb8e, nFileSizeHigh=0x0, nFileSizeLow=0x1897c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="2kfNn.bmp", cAlternateFileName="")) returned 1 [0056.905] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2kfNn.bmp") returned 37 [0056.905] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2kfNn.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\2kfnn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.905] StrStrW (lpFirst="2kfNn.bmp", lpSrch=".wctc") returned 0x0 [0056.905] GetProcessHeap () returned 0x1130000 [0056.905] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.905] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2kfNn.bmp.wctc") returned 42 [0056.905] CloseHandle (hObject=0x3c0) returned 1 [0056.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2kfNn.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\2kfnn.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\2kfNn.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\2kfnn.bmp.wctc")) returned 1 [0056.906] GetProcessHeap () returned 0x1130000 [0056.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.906] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 228 [0056.906] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.906] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1165a080, ftCreationTime.dwHighDateTime=0x1d4c7e8, ftLastAccessTime.dwLowDateTime=0x443f2c40, ftLastAccessTime.dwHighDateTime=0x1d4d2a3, ftLastWriteTime.dwLowDateTime=0x443f2c40, ftLastWriteTime.dwHighDateTime=0x1d4d2a3, nFileSizeHigh=0x0, nFileSizeLow=0xd052, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="3iUqwwmnNDpVFv0rv.mp3", cAlternateFileName="3IUQWW~1.MP3")) returned 1 [0056.906] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\3iUqwwmnNDpVFv0rv.mp3") returned 49 [0056.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\3iUqwwmnNDpVFv0rv.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\3iuqwwmnndpvfv0rv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.906] StrStrW (lpFirst="3iUqwwmnNDpVFv0rv.mp3", lpSrch=".wctc") returned 0x0 [0056.906] GetProcessHeap () returned 0x1130000 [0056.906] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.906] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\3iUqwwmnNDpVFv0rv.mp3.wctc") returned 54 [0056.906] CloseHandle (hObject=0x3c0) returned 1 [0056.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\3iUqwwmnNDpVFv0rv.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\3iuqwwmnndpvfv0rv.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\3iUqwwmnNDpVFv0rv.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\3iuqwwmnndpvfv0rv.mp3.wctc")) returned 1 [0056.906] GetProcessHeap () returned 0x1130000 [0056.906] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.906] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 229 [0056.907] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.907] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f69bff0, ftCreationTime.dwHighDateTime=0x1d4c6c9, ftLastAccessTime.dwLowDateTime=0x9d023cf0, ftLastAccessTime.dwHighDateTime=0x1d4d177, ftLastWriteTime.dwLowDateTime=0x9d023cf0, ftLastWriteTime.dwHighDateTime=0x1d4d177, nFileSizeHigh=0x0, nFileSizeLow=0x11e9e, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="4cKe6MWXhvPrE.bmp", cAlternateFileName="4CKE6M~1.BMP")) returned 1 [0056.907] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4cKe6MWXhvPrE.bmp") returned 45 [0056.907] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4cKe6MWXhvPrE.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\4cke6mwxhvpre.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.907] StrStrW (lpFirst="4cKe6MWXhvPrE.bmp", lpSrch=".wctc") returned 0x0 [0056.907] GetProcessHeap () returned 0x1130000 [0056.907] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.907] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4cKe6MWXhvPrE.bmp.wctc") returned 50 [0056.907] CloseHandle (hObject=0x3c0) returned 1 [0056.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4cKe6MWXhvPrE.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\4cke6mwxhvpre.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4cKe6MWXhvPrE.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\4cke6mwxhvpre.bmp.wctc")) returned 1 [0056.907] GetProcessHeap () returned 0x1130000 [0056.907] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.907] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 230 [0056.907] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.907] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1703ac0, ftCreationTime.dwHighDateTime=0x1d4d596, ftLastAccessTime.dwLowDateTime=0xcdd7a2f0, ftLastAccessTime.dwHighDateTime=0x1d4d59d, ftLastWriteTime.dwLowDateTime=0xcdd7a2f0, ftLastWriteTime.dwHighDateTime=0x1d4d59d, nFileSizeHigh=0x0, nFileSizeLow=0x15ced, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="4gDR8G8iAAa-Xs6U.mkv", cAlternateFileName="4GDR8G~1.MKV")) returned 1 [0056.907] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4gDR8G8iAAa-Xs6U.mkv") returned 48 [0056.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4gDR8G8iAAa-Xs6U.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\4gdr8g8iaaa-xs6u.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.908] StrStrW (lpFirst="4gDR8G8iAAa-Xs6U.mkv", lpSrch=".wctc") returned 0x0 [0056.908] GetProcessHeap () returned 0x1130000 [0056.908] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.908] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4gDR8G8iAAa-Xs6U.mkv.wctc") returned 53 [0056.908] CloseHandle (hObject=0x3c0) returned 1 [0056.908] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4gDR8G8iAAa-Xs6U.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\4gdr8g8iaaa-xs6u.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4gDR8G8iAAa-Xs6U.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\4gdr8g8iaaa-xs6u.mkv.wctc")) returned 1 [0056.908] GetProcessHeap () returned 0x1130000 [0056.908] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.908] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 231 [0056.908] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.908] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x507705e0, ftCreationTime.dwHighDateTime=0x1d4d047, ftLastAccessTime.dwLowDateTime=0x919be4b0, ftLastAccessTime.dwHighDateTime=0x1d4c80d, ftLastWriteTime.dwLowDateTime=0x919be4b0, ftLastWriteTime.dwHighDateTime=0x1d4c80d, nFileSizeHigh=0x0, nFileSizeLow=0x1571, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="4yo1le9I2I1b.gif", cAlternateFileName="4YO1LE~1.GIF")) returned 1 [0056.908] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4yo1le9I2I1b.gif") returned 44 [0056.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4yo1le9I2I1b.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\4yo1le9i2i1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.908] StrStrW (lpFirst="4yo1le9I2I1b.gif", lpSrch=".wctc") returned 0x0 [0056.908] GetProcessHeap () returned 0x1130000 [0056.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.909] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4yo1le9I2I1b.gif.wctc") returned 49 [0056.909] CloseHandle (hObject=0x3c0) returned 1 [0056.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4yo1le9I2I1b.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\4yo1le9i2i1b.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4yo1le9I2I1b.gif.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\4yo1le9i2i1b.gif.wctc")) returned 1 [0056.909] GetProcessHeap () returned 0x1130000 [0056.909] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.909] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 232 [0056.909] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.909] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1564fc0, ftCreationTime.dwHighDateTime=0x1d4c971, ftLastAccessTime.dwLowDateTime=0x6c227570, ftLastAccessTime.dwHighDateTime=0x1d4d54e, ftLastWriteTime.dwLowDateTime=0x6c227570, ftLastWriteTime.dwHighDateTime=0x1d4d54e, nFileSizeHigh=0x0, nFileSizeLow=0x17eec, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="4YRupSVTN.gif", cAlternateFileName="4YRUPS~1.GIF")) returned 1 [0056.909] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4YRupSVTN.gif") returned 41 [0056.909] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4YRupSVTN.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\4yrupsvtn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.909] StrStrW (lpFirst="4YRupSVTN.gif", lpSrch=".wctc") returned 0x0 [0056.909] GetProcessHeap () returned 0x1130000 [0056.909] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.909] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4YRupSVTN.gif.wctc") returned 46 [0056.909] CloseHandle (hObject=0x3c0) returned 1 [0056.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4YRupSVTN.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\4yrupsvtn.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\4YRupSVTN.gif.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\4yrupsvtn.gif.wctc")) returned 1 [0056.910] GetProcessHeap () returned 0x1130000 [0056.910] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.910] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 233 [0056.910] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.910] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d5b3b90, ftCreationTime.dwHighDateTime=0x1d4cbbb, ftLastAccessTime.dwLowDateTime=0x4fbdf470, ftLastAccessTime.dwHighDateTime=0x1d4cb78, ftLastWriteTime.dwLowDateTime=0x4fbdf470, ftLastWriteTime.dwHighDateTime=0x1d4cb78, nFileSizeHigh=0x0, nFileSizeLow=0xe149, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="7JlJ4jmDreQq9.pdf", cAlternateFileName="7JLJ4J~1.PDF")) returned 1 [0056.910] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\7JlJ4jmDreQq9.pdf") returned 45 [0056.910] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\7JlJ4jmDreQq9.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\7jlj4jmdreqq9.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.910] StrStrW (lpFirst="7JlJ4jmDreQq9.pdf", lpSrch=".wctc") returned 0x0 [0056.910] GetProcessHeap () returned 0x1130000 [0056.910] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.910] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\7JlJ4jmDreQq9.pdf.wctc") returned 50 [0056.910] CloseHandle (hObject=0x3c0) returned 1 [0056.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\7JlJ4jmDreQq9.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\7jlj4jmdreqq9.pdf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\7JlJ4jmDreQq9.pdf.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\7jlj4jmdreqq9.pdf.wctc")) returned 1 [0056.911] GetProcessHeap () returned 0x1130000 [0056.911] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.911] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 234 [0056.911] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.911] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21f7ec0, ftCreationTime.dwHighDateTime=0x1d4cd38, ftLastAccessTime.dwLowDateTime=0x5ccf8a80, ftLastAccessTime.dwHighDateTime=0x1d4c622, ftLastWriteTime.dwLowDateTime=0x5ccf8a80, ftLastWriteTime.dwHighDateTime=0x1d4c622, nFileSizeHigh=0x0, nFileSizeLow=0x18474, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="AmWuS-KMflieV4fFI.mp3", cAlternateFileName="AMWUS-~1.MP3")) returned 1 [0056.911] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\AmWuS-KMflieV4fFI.mp3") returned 49 [0056.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\AmWuS-KMflieV4fFI.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\amwus-kmfliev4ffi.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.911] StrStrW (lpFirst="AmWuS-KMflieV4fFI.mp3", lpSrch=".wctc") returned 0x0 [0056.911] GetProcessHeap () returned 0x1130000 [0056.911] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.911] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\AmWuS-KMflieV4fFI.mp3.wctc") returned 54 [0056.911] CloseHandle (hObject=0x3c0) returned 1 [0056.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\AmWuS-KMflieV4fFI.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\amwus-kmfliev4ffi.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\AmWuS-KMflieV4fFI.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\amwus-kmfliev4ffi.mp3.wctc")) returned 1 [0056.912] GetProcessHeap () returned 0x1130000 [0056.912] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.912] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 235 [0056.912] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.912] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ae475b0, ftCreationTime.dwHighDateTime=0x1d4cc85, ftLastAccessTime.dwLowDateTime=0xc34f3d60, ftLastAccessTime.dwHighDateTime=0x1d4cb1c, ftLastWriteTime.dwLowDateTime=0xc34f3d60, ftLastWriteTime.dwHighDateTime=0x1d4cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x14136, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="BD3JRG.avi", cAlternateFileName="")) returned 1 [0056.912] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\BD3JRG.avi") returned 38 [0056.912] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\BD3JRG.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\bd3jrg.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.912] StrStrW (lpFirst="BD3JRG.avi", lpSrch=".wctc") returned 0x0 [0056.912] GetProcessHeap () returned 0x1130000 [0056.912] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.912] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\BD3JRG.avi.wctc") returned 43 [0056.912] CloseHandle (hObject=0x3c0) returned 1 [0056.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\BD3JRG.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\bd3jrg.avi"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\BD3JRG.avi.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\bd3jrg.avi.wctc")) returned 1 [0056.913] GetProcessHeap () returned 0x1130000 [0056.913] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.913] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 236 [0056.913] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.913] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a6d1c0, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x752eb60, ftLastAccessTime.dwHighDateTime=0x1d4c613, ftLastWriteTime.dwLowDateTime=0x752eb60, ftLastWriteTime.dwHighDateTime=0x1d4c613, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Cjy 1RG4ITB4tJEzx-vR", cAlternateFileName="CJY1RG~1")) returned 1 [0056.913] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\Cjy 1RG4ITB4tJEzx-vR") returned 48 [0056.913] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb3b9680, ftCreationTime.dwHighDateTime=0x1d4cc0e, ftLastAccessTime.dwLowDateTime=0x1be46c00, ftLastAccessTime.dwHighDateTime=0x1d4d15f, ftLastWriteTime.dwLowDateTime=0x1be46c00, ftLastWriteTime.dwHighDateTime=0x1d4d15f, nFileSizeHigh=0x0, nFileSizeLow=0xb263, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="D0bu3CQ lo0UG.bmp", cAlternateFileName="D0BU3C~1.BMP")) returned 1 [0056.913] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\D0bu3CQ lo0UG.bmp") returned 45 [0056.913] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\D0bu3CQ lo0UG.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\d0bu3cq lo0ug.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.913] StrStrW (lpFirst="D0bu3CQ lo0UG.bmp", lpSrch=".wctc") returned 0x0 [0056.913] GetProcessHeap () returned 0x1130000 [0056.913] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.913] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\D0bu3CQ lo0UG.bmp.wctc") returned 50 [0056.913] CloseHandle (hObject=0x3c0) returned 1 [0056.913] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\D0bu3CQ lo0UG.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\d0bu3cq lo0ug.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\D0bu3CQ lo0UG.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\d0bu3cq lo0ug.bmp.wctc")) returned 1 [0056.913] GetProcessHeap () returned 0x1130000 [0056.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.914] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 237 [0056.914] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.914] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.914] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\desktop.ini") returned 39 [0056.914] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.914] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0056.914] GetProcessHeap () returned 0x1130000 [0056.914] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.914] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\E29jnRbK9dz8KkR.mp4.wctc") returned 52 [0056.914] CloseHandle (hObject=0x3c0) returned 1 [0056.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\E29jnRbK9dz8KkR.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\e29jnrbk9dz8kkr.mp4"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\E29jnRbK9dz8KkR.mp4.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\e29jnrbk9dz8kkr.mp4.wctc")) returned 1 [0056.914] GetProcessHeap () returned 0x1130000 [0056.914] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.915] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 238 [0056.915] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.915] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5fcbf10, ftCreationTime.dwHighDateTime=0x1d4cd43, ftLastAccessTime.dwLowDateTime=0x7f260fa0, ftLastAccessTime.dwHighDateTime=0x1d4d1df, ftLastWriteTime.dwLowDateTime=0x7f260fa0, ftLastWriteTime.dwHighDateTime=0x1d4d1df, nFileSizeHigh=0x0, nFileSizeLow=0xcbc1, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="erGTA.wav", cAlternateFileName="")) returned 1 [0056.915] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\erGTA.wav") returned 37 [0056.915] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\erGTA.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ergta.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.915] StrStrW (lpFirst="erGTA.wav", lpSrch=".wctc") returned 0x0 [0056.915] GetProcessHeap () returned 0x1130000 [0056.915] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.915] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\erGTA.wav.wctc") returned 42 [0056.915] CloseHandle (hObject=0x3c0) returned 1 [0056.915] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\erGTA.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ergta.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\erGTA.wav.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\ergta.wav.wctc")) returned 1 [0056.915] GetProcessHeap () returned 0x1130000 [0056.915] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.915] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 239 [0056.915] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.915] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4f350, ftCreationTime.dwHighDateTime=0x1d4d251, ftLastAccessTime.dwLowDateTime=0x3e8f6770, ftLastAccessTime.dwHighDateTime=0x1d4cbbd, ftLastWriteTime.dwLowDateTime=0x3e8f6770, ftLastWriteTime.dwHighDateTime=0x1d4cbbd, nFileSizeHigh=0x0, nFileSizeLow=0x9a2f, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ev-uHHsESM.png", cAlternateFileName="EV-UHH~1.PNG")) returned 1 [0056.915] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\ev-uHHsESM.png") returned 42 [0056.915] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\ev-uHHsESM.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ev-uhhsesm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.916] StrStrW (lpFirst="ev-uHHsESM.png", lpSrch=".wctc") returned 0x0 [0056.916] GetProcessHeap () returned 0x1130000 [0056.916] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.916] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\ev-uHHsESM.png.wctc") returned 47 [0056.916] CloseHandle (hObject=0x3c0) returned 1 [0056.916] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\ev-uHHsESM.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ev-uhhsesm.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\ev-uHHsESM.png.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\ev-uhhsesm.png.wctc")) returned 1 [0056.949] GetProcessHeap () returned 0x1130000 [0056.949] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.949] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 248 [0056.949] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.949] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf6eba0, ftCreationTime.dwHighDateTime=0x1d4d2a6, ftLastAccessTime.dwLowDateTime=0x9a11c7e0, ftLastAccessTime.dwHighDateTime=0x1d4c920, ftLastWriteTime.dwLowDateTime=0x9a11c7e0, ftLastWriteTime.dwHighDateTime=0x1d4c920, nFileSizeHigh=0x0, nFileSizeLow=0x16603, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="F0wW1nMN5.png", cAlternateFileName="F0WW1N~1.PNG")) returned 1 [0056.949] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\F0wW1nMN5.png") returned 41 [0056.949] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\F0wW1nMN5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\f0ww1nmn5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.949] StrStrW (lpFirst="F0wW1nMN5.png", lpSrch=".wctc") returned 0x0 [0056.949] GetProcessHeap () returned 0x1130000 [0056.949] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.949] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\F0wW1nMN5.png.wctc") returned 46 [0056.949] CloseHandle (hObject=0x3c0) returned 1 [0056.950] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\F0wW1nMN5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\f0ww1nmn5.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\F0wW1nMN5.png.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\f0ww1nmn5.png.wctc")) returned 1 [0056.950] GetProcessHeap () returned 0x1130000 [0056.950] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.950] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 249 [0056.950] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.950] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cc7f740, ftCreationTime.dwHighDateTime=0x1d4ceb1, ftLastAccessTime.dwLowDateTime=0x1812cc00, ftLastAccessTime.dwHighDateTime=0x1d4d0da, ftLastWriteTime.dwLowDateTime=0x1812cc00, ftLastWriteTime.dwHighDateTime=0x1d4d0da, nFileSizeHigh=0x0, nFileSizeLow=0xe1ee, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="H2-3O_.pptx", cAlternateFileName="H2-3O_~1.PPT")) returned 1 [0056.950] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\H2-3O_.pptx") returned 39 [0056.950] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\H2-3O_.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\h2-3o_.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.950] StrStrW (lpFirst="H2-3O_.pptx", lpSrch=".wctc") returned 0x0 [0056.950] GetProcessHeap () returned 0x1130000 [0056.950] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.950] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\H2-3O_.pptx.wctc") returned 44 [0056.950] CloseHandle (hObject=0x3c0) returned 1 [0056.950] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\H2-3O_.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\h2-3o_.pptx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\H2-3O_.pptx.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\h2-3o_.pptx.wctc")) returned 1 [0056.951] GetProcessHeap () returned 0x1130000 [0056.951] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.951] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 250 [0056.951] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.951] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e33540, ftCreationTime.dwHighDateTime=0x1d4ccd0, ftLastAccessTime.dwLowDateTime=0xea261a10, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0xea261a10, ftLastWriteTime.dwHighDateTime=0x1d4cd8f, nFileSizeHigh=0x0, nFileSizeLow=0xb973, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="hrPLAPIOHNvpcdX8wBq7.mkv", cAlternateFileName="HRPLAP~1.MKV")) returned 1 [0056.951] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\hrPLAPIOHNvpcdX8wBq7.mkv") returned 52 [0056.951] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\hrPLAPIOHNvpcdX8wBq7.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\hrplapiohnvpcdx8wbq7.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.951] StrStrW (lpFirst="hrPLAPIOHNvpcdX8wBq7.mkv", lpSrch=".wctc") returned 0x0 [0056.951] GetProcessHeap () returned 0x1130000 [0056.951] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.951] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\hrPLAPIOHNvpcdX8wBq7.mkv.wctc") returned 57 [0056.951] CloseHandle (hObject=0x3c0) returned 1 [0056.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\hrPLAPIOHNvpcdX8wBq7.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\hrplapiohnvpcdx8wbq7.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\hrPLAPIOHNvpcdX8wBq7.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\hrplapiohnvpcdx8wbq7.mkv.wctc")) returned 1 [0056.952] GetProcessHeap () returned 0x1130000 [0056.952] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.952] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 251 [0056.952] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.952] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933a9df0, ftCreationTime.dwHighDateTime=0x1d4cfcb, ftLastAccessTime.dwLowDateTime=0xff483030, ftLastAccessTime.dwHighDateTime=0x1d4c7eb, ftLastWriteTime.dwLowDateTime=0xff483030, ftLastWriteTime.dwHighDateTime=0x1d4c7eb, nFileSizeHigh=0x0, nFileSizeLow=0x137c5, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="JdYgybexemh l7Q.m4a", cAlternateFileName="JDYGYB~1.M4A")) returned 1 [0056.952] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\JdYgybexemh l7Q.m4a") returned 47 [0056.952] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\JdYgybexemh l7Q.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\jdygybexemh l7q.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.952] StrStrW (lpFirst="JdYgybexemh l7Q.m4a", lpSrch=".wctc") returned 0x0 [0056.952] GetProcessHeap () returned 0x1130000 [0056.952] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.952] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\JdYgybexemh l7Q.m4a.wctc") returned 52 [0056.952] CloseHandle (hObject=0x3c0) returned 1 [0056.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\JdYgybexemh l7Q.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\jdygybexemh l7q.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\JdYgybexemh l7Q.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\jdygybexemh l7q.m4a.wctc")) returned 1 [0056.953] GetProcessHeap () returned 0x1130000 [0056.953] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.953] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 252 [0056.953] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.953] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe294c780, ftCreationTime.dwHighDateTime=0x1d4ca2c, ftLastAccessTime.dwLowDateTime=0x352541e0, ftLastAccessTime.dwHighDateTime=0x1d4cbaa, ftLastWriteTime.dwLowDateTime=0x352541e0, ftLastWriteTime.dwHighDateTime=0x1d4cbaa, nFileSizeHigh=0x0, nFileSizeLow=0x15f19, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="L8EW JPAXqkPUV8cuVQy.mkv", cAlternateFileName="L8EWJP~1.MKV")) returned 1 [0056.953] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\L8EW JPAXqkPUV8cuVQy.mkv") returned 52 [0056.953] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\L8EW JPAXqkPUV8cuVQy.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\l8ew jpaxqkpuv8cuvqy.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.953] StrStrW (lpFirst="L8EW JPAXqkPUV8cuVQy.mkv", lpSrch=".wctc") returned 0x0 [0056.953] GetProcessHeap () returned 0x1130000 [0056.953] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.953] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\L8EW JPAXqkPUV8cuVQy.mkv.wctc") returned 57 [0056.953] CloseHandle (hObject=0x3c0) returned 1 [0056.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\L8EW JPAXqkPUV8cuVQy.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\l8ew jpaxqkpuv8cuvqy.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\L8EW JPAXqkPUV8cuVQy.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\l8ew jpaxqkpuv8cuvqy.mkv.wctc")) returned 1 [0056.953] GetProcessHeap () returned 0x1130000 [0056.953] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.953] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 253 [0056.953] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.953] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4947dda0, ftCreationTime.dwHighDateTime=0x1d4c85c, ftLastAccessTime.dwLowDateTime=0xa88a6e20, ftLastAccessTime.dwHighDateTime=0x1d4c953, ftLastWriteTime.dwLowDateTime=0xa88a6e20, ftLastWriteTime.dwHighDateTime=0x1d4c953, nFileSizeHigh=0x0, nFileSizeLow=0x13b5f, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="mt-h9_7aHlL.png", cAlternateFileName="MT-H9_~1.PNG")) returned 1 [0056.954] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\mt-h9_7aHlL.png") returned 43 [0056.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\mt-h9_7aHlL.png" (normalized: "c:\\users\\fd1hvy\\desktop\\mt-h9_7ahll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.954] StrStrW (lpFirst="mt-h9_7aHlL.png", lpSrch=".wctc") returned 0x0 [0056.954] GetProcessHeap () returned 0x1130000 [0056.954] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.954] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\mt-h9_7aHlL.png.wctc") returned 48 [0056.954] CloseHandle (hObject=0x3c0) returned 1 [0056.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\mt-h9_7aHlL.png" (normalized: "c:\\users\\fd1hvy\\desktop\\mt-h9_7ahll.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\mt-h9_7aHlL.png.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\mt-h9_7ahll.png.wctc")) returned 1 [0056.954] GetProcessHeap () returned 0x1130000 [0056.954] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.954] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 254 [0056.954] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.954] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a591500, ftCreationTime.dwHighDateTime=0x1d4d48f, ftLastAccessTime.dwLowDateTime=0x1f34f1f0, ftLastAccessTime.dwHighDateTime=0x1d4cf6f, ftLastWriteTime.dwLowDateTime=0x1f34f1f0, ftLastWriteTime.dwHighDateTime=0x1d4cf6f, nFileSizeHigh=0x0, nFileSizeLow=0xb2cb, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="N7raaBF_pN7zRB86IJxa.bmp", cAlternateFileName="N7RAAB~1.BMP")) returned 1 [0056.954] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\N7raaBF_pN7zRB86IJxa.bmp") returned 52 [0056.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\N7raaBF_pN7zRB86IJxa.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\n7raabf_pn7zrb86ijxa.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.955] StrStrW (lpFirst="N7raaBF_pN7zRB86IJxa.bmp", lpSrch=".wctc") returned 0x0 [0056.955] GetProcessHeap () returned 0x1130000 [0056.955] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.955] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\N7raaBF_pN7zRB86IJxa.bmp.wctc") returned 57 [0056.955] CloseHandle (hObject=0x3c0) returned 1 [0056.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\N7raaBF_pN7zRB86IJxa.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\n7raabf_pn7zrb86ijxa.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\N7raaBF_pN7zRB86IJxa.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\n7raabf_pn7zrb86ijxa.bmp.wctc")) returned 1 [0056.955] GetProcessHeap () returned 0x1130000 [0056.955] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.955] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 255 [0056.955] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.955] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2623c960, ftCreationTime.dwHighDateTime=0x1d4c852, ftLastAccessTime.dwLowDateTime=0x7b9ac540, ftLastAccessTime.dwHighDateTime=0x1d4c787, ftLastWriteTime.dwLowDateTime=0x7b9ac540, ftLastWriteTime.dwHighDateTime=0x1d4c787, nFileSizeHigh=0x0, nFileSizeLow=0x13b43, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="pNl1TDe9-.odp", cAlternateFileName="PNL1TD~1.ODP")) returned 1 [0056.955] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pNl1TDe9-.odp") returned 41 [0056.955] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pNl1TDe9-.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\pnl1tde9-.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.955] StrStrW (lpFirst="pNl1TDe9-.odp", lpSrch=".wctc") returned 0x0 [0056.956] GetProcessHeap () returned 0x1130000 [0056.956] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.956] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pNl1TDe9-.odp.wctc") returned 46 [0056.956] CloseHandle (hObject=0x3c0) returned 1 [0056.956] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pNl1TDe9-.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\pnl1tde9-.odp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pNl1TDe9-.odp.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\pnl1tde9-.odp.wctc")) returned 1 [0056.956] GetProcessHeap () returned 0x1130000 [0056.956] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.956] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 256 [0056.956] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.956] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bbd0ea0, ftCreationTime.dwHighDateTime=0x1d4cb63, ftLastAccessTime.dwLowDateTime=0x3a61e510, ftLastAccessTime.dwHighDateTime=0x1d4cae6, ftLastWriteTime.dwLowDateTime=0x3a61e510, ftLastWriteTime.dwHighDateTime=0x1d4cae6, nFileSizeHigh=0x0, nFileSizeLow=0xf080, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="pzmj.png", cAlternateFileName="")) returned 1 [0056.956] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pzmj.png") returned 36 [0056.956] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pzmj.png" (normalized: "c:\\users\\fd1hvy\\desktop\\pzmj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.956] StrStrW (lpFirst="pzmj.png", lpSrch=".wctc") returned 0x0 [0056.956] GetProcessHeap () returned 0x1130000 [0056.956] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.956] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pzmj.png.wctc") returned 41 [0056.957] CloseHandle (hObject=0x3c0) returned 1 [0056.957] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pzmj.png" (normalized: "c:\\users\\fd1hvy\\desktop\\pzmj.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\pzmj.png.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\pzmj.png.wctc")) returned 1 [0056.957] GetProcessHeap () returned 0x1130000 [0056.957] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.957] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 257 [0056.957] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.957] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeca94a0, ftCreationTime.dwHighDateTime=0x1d4cbe3, ftLastAccessTime.dwLowDateTime=0xee0e3f30, ftLastAccessTime.dwHighDateTime=0x1d4cb6a, ftLastWriteTime.dwLowDateTime=0xee0e3f30, ftLastWriteTime.dwHighDateTime=0x1d4cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x9604, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="QiAPpzUxpfXHQ8.bmp", cAlternateFileName="QIAPPZ~1.BMP")) returned 1 [0056.957] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\QiAPpzUxpfXHQ8.bmp") returned 46 [0056.957] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\QiAPpzUxpfXHQ8.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qiappzuxpfxhq8.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.957] StrStrW (lpFirst="QiAPpzUxpfXHQ8.bmp", lpSrch=".wctc") returned 0x0 [0056.957] GetProcessHeap () returned 0x1130000 [0056.957] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.957] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\QiAPpzUxpfXHQ8.bmp.wctc") returned 51 [0056.957] CloseHandle (hObject=0x3c0) returned 1 [0056.957] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\QiAPpzUxpfXHQ8.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qiappzuxpfxhq8.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\QiAPpzUxpfXHQ8.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\qiappzuxpfxhq8.bmp.wctc")) returned 1 [0056.959] GetProcessHeap () returned 0x1130000 [0056.959] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.959] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 258 [0056.959] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.959] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d38be2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.959] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\read_me.txt") returned 39 [0056.959] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.959] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.959] GetProcessHeap () returned 0x1130000 [0056.959] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.959] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\rh0_vD.wav.wctc") returned 43 [0056.959] CloseHandle (hObject=0x3c0) returned 1 [0056.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\rh0_vD.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\rh0_vd.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\rh0_vD.wav.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\rh0_vd.wav.wctc")) returned 1 [0056.960] GetProcessHeap () returned 0x1130000 [0056.960] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.960] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 259 [0056.960] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.960] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1db4e70, ftCreationTime.dwHighDateTime=0x1d4cc42, ftLastAccessTime.dwLowDateTime=0xba43d570, ftLastAccessTime.dwHighDateTime=0x1d4d263, ftLastWriteTime.dwLowDateTime=0xba43d570, ftLastWriteTime.dwHighDateTime=0x1d4d263, nFileSizeHigh=0x0, nFileSizeLow=0x86bb, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="RmmNSXuJ2GKO7g.odt", cAlternateFileName="RMMNSX~1.ODT")) returned 1 [0056.960] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\RmmNSXuJ2GKO7g.odt") returned 46 [0056.960] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\RmmNSXuJ2GKO7g.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\rmmnsxuj2gko7g.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.960] StrStrW (lpFirst="RmmNSXuJ2GKO7g.odt", lpSrch=".wctc") returned 0x0 [0056.960] GetProcessHeap () returned 0x1130000 [0056.960] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.960] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\RmmNSXuJ2GKO7g.odt.wctc") returned 51 [0056.960] CloseHandle (hObject=0x3c0) returned 1 [0056.960] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\RmmNSXuJ2GKO7g.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\rmmnsxuj2gko7g.odt"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\RmmNSXuJ2GKO7g.odt.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\rmmnsxuj2gko7g.odt.wctc")) returned 1 [0056.960] GetProcessHeap () returned 0x1130000 [0056.960] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.961] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 260 [0056.961] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.961] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a359030, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0x8e71c8d0, ftLastAccessTime.dwHighDateTime=0x1d4cb79, ftLastWriteTime.dwLowDateTime=0x8e71c8d0, ftLastWriteTime.dwHighDateTime=0x1d4cb79, nFileSizeHigh=0x0, nFileSizeLow=0x10398, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="sU VT0B2vGYsBNsA.m4a", cAlternateFileName="SUVT0B~1.M4A")) returned 1 [0056.961] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\sU VT0B2vGYsBNsA.m4a") returned 48 [0056.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\sU VT0B2vGYsBNsA.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\su vt0b2vgysbnsa.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.961] StrStrW (lpFirst="sU VT0B2vGYsBNsA.m4a", lpSrch=".wctc") returned 0x0 [0056.961] GetProcessHeap () returned 0x1130000 [0056.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.961] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\sU VT0B2vGYsBNsA.m4a.wctc") returned 53 [0056.961] CloseHandle (hObject=0x3c0) returned 1 [0056.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\sU VT0B2vGYsBNsA.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\su vt0b2vgysbnsa.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\sU VT0B2vGYsBNsA.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\su vt0b2vgysbnsa.m4a.wctc")) returned 1 [0056.961] GetProcessHeap () returned 0x1130000 [0056.961] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.961] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 261 [0056.961] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.961] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86067b50, ftCreationTime.dwHighDateTime=0x1d4d3da, ftLastAccessTime.dwLowDateTime=0x3f3aeb20, ftLastAccessTime.dwHighDateTime=0x1d4c656, ftLastWriteTime.dwLowDateTime=0x3f3aeb20, ftLastWriteTime.dwHighDateTime=0x1d4c656, nFileSizeHigh=0x0, nFileSizeLow=0x174f0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="UeHlJ isW_vkF.mkv", cAlternateFileName="UEHLJI~1.MKV")) returned 1 [0056.961] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\UeHlJ isW_vkF.mkv") returned 45 [0056.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\UeHlJ isW_vkF.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\uehlj isw_vkf.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.962] StrStrW (lpFirst="UeHlJ isW_vkF.mkv", lpSrch=".wctc") returned 0x0 [0056.962] GetProcessHeap () returned 0x1130000 [0056.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.962] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\UeHlJ isW_vkF.mkv.wctc") returned 50 [0056.962] CloseHandle (hObject=0x3c0) returned 1 [0056.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\UeHlJ isW_vkF.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\uehlj isw_vkf.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\UeHlJ isW_vkF.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\uehlj isw_vkf.mkv.wctc")) returned 1 [0056.962] GetProcessHeap () returned 0x1130000 [0056.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.962] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 262 [0056.962] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.962] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8af1bd0, ftCreationTime.dwHighDateTime=0x1d4c83c, ftLastAccessTime.dwLowDateTime=0x2f86cb40, ftLastAccessTime.dwHighDateTime=0x1d4c9df, ftLastWriteTime.dwLowDateTime=0x2f86cb40, ftLastWriteTime.dwHighDateTime=0x1d4c9df, nFileSizeHigh=0x0, nFileSizeLow=0x1653c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="V8ami1QL1il1OYi26Nh.ots", cAlternateFileName="V8AMI1~1.OTS")) returned 1 [0056.962] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\V8ami1QL1il1OYi26Nh.ots") returned 51 [0056.962] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\V8ami1QL1il1OYi26Nh.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\v8ami1ql1il1oyi26nh.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.962] StrStrW (lpFirst="V8ami1QL1il1OYi26Nh.ots", lpSrch=".wctc") returned 0x0 [0056.962] GetProcessHeap () returned 0x1130000 [0056.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.963] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\V8ami1QL1il1OYi26Nh.ots.wctc") returned 56 [0056.963] CloseHandle (hObject=0x3c0) returned 1 [0056.963] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\V8ami1QL1il1OYi26Nh.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\v8ami1ql1il1oyi26nh.ots"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\V8ami1QL1il1OYi26Nh.ots.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\v8ami1ql1il1oyi26nh.ots.wctc")) returned 1 [0056.963] GetProcessHeap () returned 0x1130000 [0056.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.963] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 263 [0056.963] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.963] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0655700, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xd0655700, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xcf342a00, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0xdc00, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="wzmjbq.exe", cAlternateFileName="")) returned 1 [0056.963] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\wzmjbq.exe") returned 38 [0056.963] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\wzmjbq.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\wzmjbq.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.964] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda3c6430, ftCreationTime.dwHighDateTime=0x1d4d229, ftLastAccessTime.dwLowDateTime=0x65e39530, ftLastAccessTime.dwHighDateTime=0x1d4c974, ftLastWriteTime.dwLowDateTime=0x65e39530, ftLastWriteTime.dwHighDateTime=0x1d4c974, nFileSizeHigh=0x0, nFileSizeLow=0x23aa, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="x4EAa.wav", cAlternateFileName="")) returned 1 [0056.964] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\x4EAa.wav") returned 37 [0056.964] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\x4EAa.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\x4eaa.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.964] StrStrW (lpFirst="x4EAa.wav", lpSrch=".wctc") returned 0x0 [0056.964] GetProcessHeap () returned 0x1130000 [0056.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.964] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\x4EAa.wav.wctc") returned 42 [0056.964] CloseHandle (hObject=0x3c0) returned 1 [0056.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\x4EAa.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\x4eaa.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\x4EAa.wav.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\x4eaa.wav.wctc")) returned 1 [0056.964] GetProcessHeap () returned 0x1130000 [0056.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.965] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 264 [0056.965] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.965] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69caca50, ftCreationTime.dwHighDateTime=0x1d4d410, ftLastAccessTime.dwLowDateTime=0x28b68690, ftLastAccessTime.dwHighDateTime=0x1d4d234, ftLastWriteTime.dwLowDateTime=0x28b68690, ftLastWriteTime.dwHighDateTime=0x1d4d234, nFileSizeHigh=0x0, nFileSizeLow=0xf6a5, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="XlU1o2gWAz2omnCdH51c.gif", cAlternateFileName="XLU1O2~1.GIF")) returned 1 [0056.965] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XlU1o2gWAz2omnCdH51c.gif") returned 52 [0056.965] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XlU1o2gWAz2omnCdH51c.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\xlu1o2gwaz2omncdh51c.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.965] StrStrW (lpFirst="XlU1o2gWAz2omnCdH51c.gif", lpSrch=".wctc") returned 0x0 [0056.965] GetProcessHeap () returned 0x1130000 [0056.965] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.965] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XlU1o2gWAz2omnCdH51c.gif.wctc") returned 57 [0056.965] CloseHandle (hObject=0x3c0) returned 1 [0056.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XlU1o2gWAz2omnCdH51c.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\xlu1o2gwaz2omncdh51c.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XlU1o2gWAz2omnCdH51c.gif.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\xlu1o2gwaz2omncdh51c.gif.wctc")) returned 1 [0056.965] GetProcessHeap () returned 0x1130000 [0056.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.965] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 265 [0056.965] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.965] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2886200, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0x19e7a3c0, ftLastAccessTime.dwHighDateTime=0x1d4ce00, ftLastWriteTime.dwLowDateTime=0x19e7a3c0, ftLastWriteTime.dwHighDateTime=0x1d4ce00, nFileSizeHigh=0x0, nFileSizeLow=0x6205, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="XYUlBrgGzIYK82n.m4a", cAlternateFileName="XYULBR~1.M4A")) returned 1 [0056.965] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XYUlBrgGzIYK82n.m4a") returned 47 [0056.966] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XYUlBrgGzIYK82n.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\xyulbrggziyk82n.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.966] StrStrW (lpFirst="XYUlBrgGzIYK82n.m4a", lpSrch=".wctc") returned 0x0 [0056.966] GetProcessHeap () returned 0x1130000 [0056.966] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.966] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XYUlBrgGzIYK82n.m4a.wctc") returned 52 [0056.966] CloseHandle (hObject=0x3c0) returned 1 [0056.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XYUlBrgGzIYK82n.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\xyulbrggziyk82n.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\XYUlBrgGzIYK82n.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\desktop\\xyulbrggziyk82n.m4a.wctc")) returned 1 [0056.966] GetProcessHeap () returned 0x1130000 [0056.966] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.966] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 266 [0056.966] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.966] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2886200, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0x19e7a3c0, ftLastAccessTime.dwHighDateTime=0x1d4ce00, ftLastWriteTime.dwLowDateTime=0x19e7a3c0, ftLastWriteTime.dwHighDateTime=0x1d4ce00, nFileSizeHigh=0x0, nFileSizeLow=0x6205, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="xyulbrggziyk82n.m4a", cAlternateFileName="XYULBR~1.M4A")) returned 0 [0056.966] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0056.966] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\read_me.txt") returned 39 [0056.966] GetProcessHeap () returned 0x1130000 [0056.966] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.969] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 113 [0056.969] GetProcessHeap () returned 0x1130000 [0056.969] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d50100 | out: hHeap=0x1130000) returned 1 [0056.969] GetProcessHeap () returned 0x1130000 [0056.969] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.970] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\*") returned 31 [0056.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd5714832, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0056.970] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\.") returned 31 [0056.970] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd5714832, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0056.971] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\..") returned 32 [0056.971] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x420ac380, ftCreationTime.dwHighDateTime=0x1d566f5, ftLastAccessTime.dwLowDateTime=0xc5cf16a0, ftLastAccessTime.dwHighDateTime=0x1d53fed, ftLastWriteTime.dwLowDateTime=0xc5cf16a0, ftLastWriteTime.dwHighDateTime=0x1d53fed, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="-xbISA8v.pptx", cAlternateFileName="-XBISA~1.PPT")) returned 1 [0056.971] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\-xbISA8v.pptx") returned 43 [0056.971] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\-xbISA8v.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\-xbisa8v.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.971] StrStrW (lpFirst="-xbISA8v.pptx", lpSrch=".wctc") returned 0x0 [0056.971] GetProcessHeap () returned 0x1130000 [0056.971] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.972] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\-xbISA8v.pptx.wctc") returned 48 [0056.972] CloseHandle (hObject=0x3c0) returned 1 [0056.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\-xbISA8v.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\-xbisa8v.pptx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\-xbISA8v.pptx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\-xbisa8v.pptx.wctc")) returned 1 [0056.975] GetProcessHeap () returned 0x1130000 [0056.975] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.975] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 267 [0056.975] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.975] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8455c270, ftCreationTime.dwHighDateTime=0x1d56b56, ftLastAccessTime.dwLowDateTime=0xb1e61320, ftLastAccessTime.dwHighDateTime=0x1d54167, ftLastWriteTime.dwLowDateTime=0xb1e61320, ftLastWriteTime.dwHighDateTime=0x1d54167, nFileSizeHigh=0x0, nFileSizeLow=0x18d97, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="7i_y Ao9pPFq4wo.docx", cAlternateFileName="7I_YAO~1.DOC")) returned 1 [0056.975] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\7i_y Ao9pPFq4wo.docx") returned 50 [0056.975] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\7i_y Ao9pPFq4wo.docx" (normalized: "c:\\users\\fd1hvy\\documents\\7i_y ao9ppfq4wo.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.975] StrStrW (lpFirst="7i_y Ao9pPFq4wo.docx", lpSrch=".wctc") returned 0x0 [0056.975] GetProcessHeap () returned 0x1130000 [0056.975] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.975] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\7i_y Ao9pPFq4wo.docx.wctc") returned 55 [0056.975] CloseHandle (hObject=0x3c0) returned 1 [0056.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\7i_y Ao9pPFq4wo.docx" (normalized: "c:\\users\\fd1hvy\\documents\\7i_y ao9ppfq4wo.docx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\7i_y Ao9pPFq4wo.docx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\7i_y ao9ppfq4wo.docx.wctc")) returned 1 [0056.976] GetProcessHeap () returned 0x1130000 [0056.976] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.976] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 268 [0056.976] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.976] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80ec4240, ftCreationTime.dwHighDateTime=0x1d578f7, ftLastAccessTime.dwLowDateTime=0x2abda020, ftLastAccessTime.dwHighDateTime=0x1d58a1e, ftLastWriteTime.dwLowDateTime=0x2abda020, ftLastWriteTime.dwHighDateTime=0x1d58a1e, nFileSizeHigh=0x0, nFileSizeLow=0xb163, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="9x314WbI8zL8UZS.xlsx", cAlternateFileName="9X314W~1.XLS")) returned 1 [0056.976] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\9x314WbI8zL8UZS.xlsx") returned 50 [0056.976] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\9x314WbI8zL8UZS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9x314wbi8zl8uzs.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.976] StrStrW (lpFirst="9x314WbI8zL8UZS.xlsx", lpSrch=".wctc") returned 0x0 [0056.976] GetProcessHeap () returned 0x1130000 [0056.976] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.976] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\9x314WbI8zL8UZS.xlsx.wctc") returned 55 [0056.976] CloseHandle (hObject=0x3c0) returned 1 [0056.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\9x314WbI8zL8UZS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9x314wbi8zl8uzs.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\9x314WbI8zL8UZS.xlsx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\9x314wbi8zl8uzs.xlsx.wctc")) returned 1 [0056.977] GetProcessHeap () returned 0x1130000 [0056.977] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.977] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 269 [0056.977] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.977] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e878c0, ftCreationTime.dwHighDateTime=0x1d51dbf, ftLastAccessTime.dwLowDateTime=0x6c1155a0, ftLastAccessTime.dwHighDateTime=0x1d543b3, ftLastWriteTime.dwLowDateTime=0x6c1155a0, ftLastWriteTime.dwHighDateTime=0x1d543b3, nFileSizeHigh=0x0, nFileSizeLow=0x1485d, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="CTTEk.docx", cAlternateFileName="CTTEK~1.DOC")) returned 1 [0056.977] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\CTTEk.docx") returned 40 [0056.977] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\CTTEk.docx" (normalized: "c:\\users\\fd1hvy\\documents\\cttek.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.977] StrStrW (lpFirst="CTTEk.docx", lpSrch=".wctc") returned 0x0 [0056.977] GetProcessHeap () returned 0x1130000 [0056.977] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.977] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\CTTEk.docx.wctc") returned 45 [0056.977] CloseHandle (hObject=0x3c0) returned 1 [0056.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\CTTEk.docx" (normalized: "c:\\users\\fd1hvy\\documents\\cttek.docx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\CTTEk.docx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\cttek.docx.wctc")) returned 1 [0056.978] GetProcessHeap () returned 0x1130000 [0056.978] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.978] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 270 [0056.978] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.978] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6266f70, ftCreationTime.dwHighDateTime=0x1d54a55, ftLastAccessTime.dwLowDateTime=0xa6609080, ftLastAccessTime.dwHighDateTime=0x1d597ec, ftLastWriteTime.dwLowDateTime=0xa6609080, ftLastWriteTime.dwHighDateTime=0x1d597ec, nFileSizeHigh=0x0, nFileSizeLow=0x10048, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="czTIg29OnY.pptx", cAlternateFileName="CZTIG2~1.PPT")) returned 1 [0056.978] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\czTIg29OnY.pptx") returned 45 [0056.978] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\czTIg29OnY.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\cztig29ony.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.978] StrStrW (lpFirst="czTIg29OnY.pptx", lpSrch=".wctc") returned 0x0 [0056.978] GetProcessHeap () returned 0x1130000 [0056.978] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.978] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\czTIg29OnY.pptx.wctc") returned 50 [0056.978] CloseHandle (hObject=0x3c0) returned 1 [0056.978] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\czTIg29OnY.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\cztig29ony.pptx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\czTIg29OnY.pptx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\cztig29ony.pptx.wctc")) returned 1 [0056.979] GetProcessHeap () returned 0x1130000 [0056.979] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.979] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 271 [0056.979] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.979] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0056.979] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned 45 [0056.979] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.979] StrStrW (lpFirst="Database1.accdb", lpSrch=".wctc") returned 0x0 [0056.979] GetProcessHeap () returned 0x1130000 [0056.979] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.979] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Database1.accdb.wctc") returned 50 [0056.979] CloseHandle (hObject=0x3c0) returned 1 [0056.979] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Database1.accdb.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.wctc")) returned 1 [0056.980] GetProcessHeap () returned 0x1130000 [0056.981] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.981] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 272 [0056.981] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.981] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.981] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned 41 [0056.981] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.981] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0056.981] GetProcessHeap () returned 0x1130000 [0056.981] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.981] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\eoPtGkLuE9EY4bnIn1V.pptx.wctc") returned 59 [0056.981] CloseHandle (hObject=0x3c0) returned 1 [0056.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\eoPtGkLuE9EY4bnIn1V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\eoptgklue9ey4bnin1v.pptx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\eoPtGkLuE9EY4bnIn1V.pptx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\eoptgklue9ey4bnin1v.pptx.wctc")) returned 1 [0056.982] GetProcessHeap () returned 0x1130000 [0056.982] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.982] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 273 [0056.982] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.982] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f11d50, ftCreationTime.dwHighDateTime=0x1d56d88, ftLastAccessTime.dwLowDateTime=0x18ec9740, ftLastAccessTime.dwHighDateTime=0x1d54c0a, ftLastWriteTime.dwLowDateTime=0x18ec9740, ftLastWriteTime.dwHighDateTime=0x1d54c0a, nFileSizeHigh=0x0, nFileSizeLow=0x244d, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="EuH6LKnng.docx", cAlternateFileName="EUH6LK~1.DOC")) returned 1 [0056.982] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\EuH6LKnng.docx") returned 44 [0056.982] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\EuH6LKnng.docx" (normalized: "c:\\users\\fd1hvy\\documents\\euh6lknng.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.982] StrStrW (lpFirst="EuH6LKnng.docx", lpSrch=".wctc") returned 0x0 [0056.982] GetProcessHeap () returned 0x1130000 [0056.982] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.982] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\EuH6LKnng.docx.wctc") returned 49 [0056.982] CloseHandle (hObject=0x3c0) returned 1 [0056.982] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\EuH6LKnng.docx" (normalized: "c:\\users\\fd1hvy\\documents\\euh6lknng.docx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\EuH6LKnng.docx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\euh6lknng.docx.wctc")) returned 1 [0056.983] GetProcessHeap () returned 0x1130000 [0056.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.983] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 274 [0056.983] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.983] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2acea0b0, ftCreationTime.dwHighDateTime=0x1d4cf8d, ftLastAccessTime.dwLowDateTime=0x5f4efea0, ftLastAccessTime.dwHighDateTime=0x1d4c6c0, ftLastWriteTime.dwLowDateTime=0x5f4efea0, ftLastWriteTime.dwHighDateTime=0x1d4c6c0, nFileSizeHigh=0x0, nFileSizeLow=0x10a81, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="hh_Ow.doc", cAlternateFileName="")) returned 1 [0056.983] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\hh_Ow.doc") returned 39 [0056.983] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\hh_Ow.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hh_ow.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.983] StrStrW (lpFirst="hh_Ow.doc", lpSrch=".wctc") returned 0x0 [0056.983] GetProcessHeap () returned 0x1130000 [0056.983] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.983] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\hh_Ow.doc.wctc") returned 44 [0056.983] CloseHandle (hObject=0x3c0) returned 1 [0056.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\hh_Ow.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hh_ow.doc"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\hh_Ow.doc.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\hh_ow.doc.wctc")) returned 1 [0056.983] GetProcessHeap () returned 0x1130000 [0056.983] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.983] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 275 [0056.983] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.984] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x415c16b0, ftCreationTime.dwHighDateTime=0x1d52059, ftLastAccessTime.dwLowDateTime=0x12c16a60, ftLastAccessTime.dwHighDateTime=0x1d51520, ftLastWriteTime.dwLowDateTime=0x12c16a60, ftLastWriteTime.dwHighDateTime=0x1d51520, nFileSizeHigh=0x0, nFileSizeLow=0x6d54, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="HuBcXNhltBC5MK.xlsx", cAlternateFileName="HUBCXN~1.XLS")) returned 1 [0056.984] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\HuBcXNhltBC5MK.xlsx") returned 49 [0056.984] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\HuBcXNhltBC5MK.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hubcxnhltbc5mk.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.984] StrStrW (lpFirst="HuBcXNhltBC5MK.xlsx", lpSrch=".wctc") returned 0x0 [0056.984] GetProcessHeap () returned 0x1130000 [0056.984] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.984] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\HuBcXNhltBC5MK.xlsx.wctc") returned 54 [0056.984] CloseHandle (hObject=0x3c0) returned 1 [0056.984] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\HuBcXNhltBC5MK.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hubcxnhltbc5mk.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\HuBcXNhltBC5MK.xlsx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\hubcxnhltbc5mk.xlsx.wctc")) returned 1 [0056.984] GetProcessHeap () returned 0x1130000 [0056.984] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.984] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 276 [0056.984] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.984] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e75f0, ftCreationTime.dwHighDateTime=0x1d4c74e, ftLastAccessTime.dwLowDateTime=0xbdafef90, ftLastAccessTime.dwHighDateTime=0x1d4c634, ftLastWriteTime.dwLowDateTime=0xbdafef90, ftLastWriteTime.dwHighDateTime=0x1d4c634, nFileSizeHigh=0x0, nFileSizeLow=0xad91, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="j1VMynQXA.doc", cAlternateFileName="J1VMYN~1.DOC")) returned 1 [0056.984] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\j1VMynQXA.doc") returned 43 [0056.984] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\j1VMynQXA.doc" (normalized: "c:\\users\\fd1hvy\\documents\\j1vmynqxa.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.985] StrStrW (lpFirst="j1VMynQXA.doc", lpSrch=".wctc") returned 0x0 [0056.985] GetProcessHeap () returned 0x1130000 [0056.985] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.985] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\j1VMynQXA.doc.wctc") returned 48 [0056.985] CloseHandle (hObject=0x3c0) returned 1 [0056.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\j1VMynQXA.doc" (normalized: "c:\\users\\fd1hvy\\documents\\j1vmynqxa.doc"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\j1VMynQXA.doc.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\j1vmynqxa.doc.wctc")) returned 1 [0056.985] GetProcessHeap () returned 0x1130000 [0056.985] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.985] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 277 [0056.985] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.985] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffabcc90, ftCreationTime.dwHighDateTime=0x1d4d276, ftLastAccessTime.dwLowDateTime=0x8d401e0, ftLastAccessTime.dwHighDateTime=0x1d4d0ef, ftLastWriteTime.dwLowDateTime=0x8d401e0, ftLastWriteTime.dwHighDateTime=0x1d4d0ef, nFileSizeHigh=0x0, nFileSizeLow=0xb208, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="jFNJQ8PNj92.xlsx", cAlternateFileName="JFNJQ8~1.XLS")) returned 1 [0056.985] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\jFNJQ8PNj92.xlsx") returned 46 [0056.985] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\jFNJQ8PNj92.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\jfnjq8pnj92.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.985] StrStrW (lpFirst="jFNJQ8PNj92.xlsx", lpSrch=".wctc") returned 0x0 [0056.985] GetProcessHeap () returned 0x1130000 [0056.985] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.985] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\jFNJQ8PNj92.xlsx.wctc") returned 51 [0056.986] CloseHandle (hObject=0x3c0) returned 1 [0056.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\jFNJQ8PNj92.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\jfnjq8pnj92.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\jFNJQ8PNj92.xlsx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\jfnjq8pnj92.xlsx.wctc")) returned 1 [0056.986] GetProcessHeap () returned 0x1130000 [0056.986] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.986] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 278 [0056.986] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.986] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0056.986] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music") returned 38 [0056.986] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0056.986] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Pictures") returned 41 [0056.986] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0056.986] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes") returned 39 [0056.986] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0056.986] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos") returned 39 [0056.986] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc98ef1e0, ftCreationTime.dwHighDateTime=0x1d4c859, ftLastAccessTime.dwLowDateTime=0x70350dd0, ftLastAccessTime.dwHighDateTime=0x1d4cd06, ftLastWriteTime.dwLowDateTime=0x70350dd0, ftLastWriteTime.dwHighDateTime=0x1d4cd06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Nj_YqnRaj2", cAlternateFileName="NJ_YQN~1")) returned 1 [0056.986] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2") returned 40 [0056.986] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f12fc50, ftCreationTime.dwHighDateTime=0x1d4cbf1, ftLastAccessTime.dwLowDateTime=0x78738950, ftLastAccessTime.dwHighDateTime=0x1d4d0b6, ftLastWriteTime.dwLowDateTime=0x78738950, ftLastWriteTime.dwHighDateTime=0x1d4d0b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ODxegLUCjB3vxT6qFqgY", cAlternateFileName="ODXEGL~1")) returned 1 [0056.986] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY") returned 50 [0056.986] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d7df980, ftCreationTime.dwHighDateTime=0x1d5824c, ftLastAccessTime.dwLowDateTime=0xe45c4a80, ftLastAccessTime.dwHighDateTime=0x1d51ec2, ftLastWriteTime.dwLowDateTime=0xe45c4a80, ftLastWriteTime.dwHighDateTime=0x1d51ec2, nFileSizeHigh=0x0, nFileSizeLow=0x609b, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="orUqeBO4u9N3jhiMP.pptx", cAlternateFileName="ORUQEB~1.PPT")) returned 1 [0056.986] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\orUqeBO4u9N3jhiMP.pptx") returned 52 [0056.986] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\orUqeBO4u9N3jhiMP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\oruqebo4u9n3jhimp.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.987] StrStrW (lpFirst="orUqeBO4u9N3jhiMP.pptx", lpSrch=".wctc") returned 0x0 [0056.987] GetProcessHeap () returned 0x1130000 [0056.987] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.987] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\orUqeBO4u9N3jhiMP.pptx.wctc") returned 57 [0056.987] CloseHandle (hObject=0x3c0) returned 1 [0056.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\orUqeBO4u9N3jhiMP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\oruqebo4u9n3jhimp.pptx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\orUqeBO4u9N3jhiMP.pptx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\oruqebo4u9n3jhimp.pptx.wctc")) returned 1 [0056.987] GetProcessHeap () returned 0x1130000 [0056.987] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.987] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 279 [0056.987] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.987] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0056.987] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned 43 [0056.987] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf376a10, ftCreationTime.dwHighDateTime=0x1d52249, ftLastAccessTime.dwLowDateTime=0x3c192190, ftLastAccessTime.dwHighDateTime=0x1d54d75, ftLastWriteTime.dwLowDateTime=0x3c192190, ftLastWriteTime.dwHighDateTime=0x1d54d75, nFileSizeHigh=0x0, nFileSizeLow=0xd41e, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="p5Kd5nuz.xlsx", cAlternateFileName="P5KD5N~1.XLS")) returned 1 [0056.987] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\p5Kd5nuz.xlsx") returned 43 [0056.987] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\p5Kd5nuz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\p5kd5nuz.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.988] StrStrW (lpFirst="p5Kd5nuz.xlsx", lpSrch=".wctc") returned 0x0 [0056.988] GetProcessHeap () returned 0x1130000 [0056.988] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.988] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\p5Kd5nuz.xlsx.wctc") returned 48 [0056.988] CloseHandle (hObject=0x3c0) returned 1 [0056.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\p5Kd5nuz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\p5kd5nuz.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\p5Kd5nuz.xlsx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\p5kd5nuz.xlsx.wctc")) returned 1 [0056.988] GetProcessHeap () returned 0x1130000 [0056.988] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.988] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 280 [0056.988] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.988] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb667b, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fb667b, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.988] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\read_me.txt") returned 41 [0056.988] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.988] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.989] GetProcessHeap () returned 0x1130000 [0056.989] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.989] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\t3vanxpBS9EW.xlsx.wctc") returned 52 [0056.989] CloseHandle (hObject=0x3c0) returned 1 [0056.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\t3vanxpBS9EW.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\t3vanxpbs9ew.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\t3vanxpBS9EW.xlsx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\t3vanxpbs9ew.xlsx.wctc")) returned 1 [0056.989] GetProcessHeap () returned 0x1130000 [0056.989] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.989] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 281 [0056.989] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.989] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fac4d50, ftCreationTime.dwHighDateTime=0x1d5862c, ftLastAccessTime.dwLowDateTime=0x3bb5a130, ftLastAccessTime.dwHighDateTime=0x1d58af4, ftLastWriteTime.dwLowDateTime=0x3bb5a130, ftLastWriteTime.dwHighDateTime=0x1d58af4, nFileSizeHigh=0x0, nFileSizeLow=0x1826f, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="tLfh0e_ZvD.pptx", cAlternateFileName="TLFH0E~1.PPT")) returned 1 [0056.989] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\tLfh0e_ZvD.pptx") returned 45 [0056.989] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\tLfh0e_ZvD.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\tlfh0e_zvd.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.990] StrStrW (lpFirst="tLfh0e_ZvD.pptx", lpSrch=".wctc") returned 0x0 [0056.990] GetProcessHeap () returned 0x1130000 [0056.990] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.990] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\tLfh0e_ZvD.pptx.wctc") returned 50 [0056.990] CloseHandle (hObject=0x3c0) returned 1 [0056.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\tLfh0e_ZvD.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\tlfh0e_zvd.pptx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\tLfh0e_ZvD.pptx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\tlfh0e_zvd.pptx.wctc")) returned 1 [0056.990] GetProcessHeap () returned 0x1130000 [0056.990] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.990] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 282 [0056.990] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.990] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d2f2080, ftCreationTime.dwHighDateTime=0x1d4cb35, ftLastAccessTime.dwLowDateTime=0x313259c0, ftLastAccessTime.dwHighDateTime=0x1d4cc8f, ftLastWriteTime.dwLowDateTime=0x313259c0, ftLastWriteTime.dwHighDateTime=0x1d4cc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="v2ue", cAlternateFileName="")) returned 1 [0056.990] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue") returned 34 [0056.990] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39b3eb0, ftCreationTime.dwHighDateTime=0x1d4cbb2, ftLastAccessTime.dwLowDateTime=0x113e4eb0, ftLastAccessTime.dwHighDateTime=0x1d4cfc5, ftLastWriteTime.dwLowDateTime=0x113e4eb0, ftLastWriteTime.dwHighDateTime=0x1d4cfc5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="xP9DBmCz", cAlternateFileName="")) returned 1 [0056.990] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz") returned 38 [0056.990] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae99df40, ftCreationTime.dwHighDateTime=0x1d55c4b, ftLastAccessTime.dwLowDateTime=0x185a5680, ftLastAccessTime.dwHighDateTime=0x1d55edb, ftLastWriteTime.dwLowDateTime=0x185a5680, ftLastWriteTime.dwHighDateTime=0x1d55edb, nFileSizeHigh=0x0, nFileSizeLow=0xfdd2, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="YAH3CCpUrYvB0pvd0I8K.xlsx", cAlternateFileName="YAH3CC~1.XLS")) returned 1 [0056.990] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\YAH3CCpUrYvB0pvd0I8K.xlsx") returned 55 [0056.990] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\YAH3CCpUrYvB0pvd0I8K.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yah3ccpuryvb0pvd0i8k.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.991] StrStrW (lpFirst="YAH3CCpUrYvB0pvd0I8K.xlsx", lpSrch=".wctc") returned 0x0 [0056.991] GetProcessHeap () returned 0x1130000 [0056.991] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.991] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\YAH3CCpUrYvB0pvd0I8K.xlsx.wctc") returned 60 [0056.991] CloseHandle (hObject=0x3c0) returned 1 [0056.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\YAH3CCpUrYvB0pvd0I8K.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yah3ccpuryvb0pvd0i8k.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\YAH3CCpUrYvB0pvd0I8K.xlsx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\yah3ccpuryvb0pvd0i8k.xlsx.wctc")) returned 1 [0056.991] GetProcessHeap () returned 0x1130000 [0056.991] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.991] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 283 [0056.991] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.991] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6fd3e20, ftCreationTime.dwHighDateTime=0x1d54a6d, ftLastAccessTime.dwLowDateTime=0xb65ece20, ftLastAccessTime.dwHighDateTime=0x1d561e1, ftLastWriteTime.dwLowDateTime=0xb65ece20, ftLastWriteTime.dwHighDateTime=0x1d561e1, nFileSizeHigh=0x0, nFileSizeLow=0x2f65, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ytN4M4p.docx", cAlternateFileName="YTN4M4~1.DOC")) returned 1 [0056.991] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ytN4M4p.docx") returned 42 [0056.991] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ytN4M4p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ytn4m4p.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.991] StrStrW (lpFirst="ytN4M4p.docx", lpSrch=".wctc") returned 0x0 [0056.992] GetProcessHeap () returned 0x1130000 [0056.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.992] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ytN4M4p.docx.wctc") returned 47 [0056.992] CloseHandle (hObject=0x3c0) returned 1 [0056.992] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ytN4M4p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ytn4m4p.docx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ytN4M4p.docx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\ytn4m4p.docx.wctc")) returned 1 [0056.992] GetProcessHeap () returned 0x1130000 [0056.992] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.992] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 284 [0056.992] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.992] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fb75f0, ftCreationTime.dwHighDateTime=0x1d4c7bb, ftLastAccessTime.dwLowDateTime=0x85284450, ftLastAccessTime.dwHighDateTime=0x1d4ca9a, ftLastWriteTime.dwLowDateTime=0x85284450, ftLastWriteTime.dwHighDateTime=0x1d4ca9a, nFileSizeHigh=0x0, nFileSizeLow=0x11415, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="zIh-.ppt", cAlternateFileName="")) returned 1 [0056.992] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\zIh-.ppt") returned 38 [0056.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\zIh-.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\zih-.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.992] StrStrW (lpFirst="zIh-.ppt", lpSrch=".wctc") returned 0x0 [0056.992] GetProcessHeap () returned 0x1130000 [0056.992] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.992] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\zIh-.ppt.wctc") returned 43 [0056.992] CloseHandle (hObject=0x3c0) returned 1 [0056.992] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\zIh-.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\zih-.ppt"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\zIh-.ppt.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\zih-.ppt.wctc")) returned 1 [0056.993] GetProcessHeap () returned 0x1130000 [0056.993] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.993] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 285 [0056.993] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.993] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba031350, ftCreationTime.dwHighDateTime=0x1d560f7, ftLastAccessTime.dwLowDateTime=0x6d9fab20, ftLastAccessTime.dwHighDateTime=0x1d59d76, ftLastWriteTime.dwLowDateTime=0x6d9fab20, ftLastWriteTime.dwHighDateTime=0x1d59d76, nFileSizeHigh=0x0, nFileSizeLow=0x11805, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Zo0JmwKfeid.docx", cAlternateFileName="ZO0JMW~1.DOC")) returned 1 [0056.993] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Zo0JmwKfeid.docx") returned 46 [0056.993] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Zo0JmwKfeid.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zo0jmwkfeid.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0056.993] StrStrW (lpFirst="Zo0JmwKfeid.docx", lpSrch=".wctc") returned 0x0 [0056.993] GetProcessHeap () returned 0x1130000 [0056.993] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.993] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Zo0JmwKfeid.docx.wctc") returned 51 [0056.993] CloseHandle (hObject=0x3c0) returned 1 [0056.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Zo0JmwKfeid.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zo0jmwkfeid.docx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Zo0JmwKfeid.docx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\zo0jmwkfeid.docx.wctc")) returned 1 [0056.994] GetProcessHeap () returned 0x1130000 [0056.994] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.994] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 286 [0056.994] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0056.994] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba031350, ftCreationTime.dwHighDateTime=0x1d560f7, ftLastAccessTime.dwLowDateTime=0x6d9fab20, ftLastAccessTime.dwHighDateTime=0x1d59d76, ftLastWriteTime.dwLowDateTime=0x6d9fab20, ftLastWriteTime.dwHighDateTime=0x1d59d76, nFileSizeHigh=0x0, nFileSizeLow=0x11805, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="zo0jmwkfeid.docx", cAlternateFileName="ZO0JMW~1.DOC")) returned 0 [0056.994] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0057.000] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\read_me.txt") returned 41 [0057.000] GetProcessHeap () returned 0x1130000 [0057.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.000] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 116 [0057.000] GetProcessHeap () returned 0x1130000 [0057.000] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d60108 | out: hHeap=0x1130000) returned 1 [0057.003] GetProcessHeap () returned 0x1130000 [0057.003] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.003] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\*") returned 41 [0057.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.004] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\.") returned 41 [0057.004] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.004] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\..") returned 42 [0057.004] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.004] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned 51 [0057.004] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.004] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.004] GetProcessHeap () returned 0x1130000 [0057.004] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.005] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.wctc") returned 59 [0057.005] CloseHandle (hObject=0x3c0) returned 1 [0057.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx.wctc")) returned 1 [0057.005] GetProcessHeap () returned 0x1130000 [0057.005] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.005] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 287 [0057.005] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.005] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e43d66, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e43d66, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.005] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\read_me.txt") returned 51 [0057.006] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.006] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.006] GetProcessHeap () returned 0x1130000 [0057.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.006] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 117 [0057.006] GetProcessHeap () returned 0x1130000 [0057.006] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3db0130 | out: hHeap=0x1130000) returned 1 [0057.006] GetProcessHeap () returned 0x1130000 [0057.006] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.006] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*") returned 50 [0057.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.006] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\.") returned 50 [0057.006] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.006] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\..") returned 51 [0057.006] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0057.007] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned 59 [0057.007] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.007] StrStrW (lpFirst="folder.ico", lpSrch=".wctc") returned 0x0 [0057.007] GetProcessHeap () returned 0x1130000 [0057.007] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.007] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.wctc") returned 64 [0057.007] CloseHandle (hObject=0x3c0) returned 1 [0057.007] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico.wctc")) returned 1 [0057.007] GetProcessHeap () returned 0x1130000 [0057.007] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.008] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 288 [0057.008] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.008] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e43d66, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e43d66, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.008] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\read_me.txt") returned 60 [0057.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.008] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.008] GetProcessHeap () returned 0x1130000 [0057.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.008] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 118 [0057.008] GetProcessHeap () returned 0x1130000 [0057.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3dd0140 | out: hHeap=0x1130000) returned 1 [0057.008] GetProcessHeap () returned 0x1130000 [0057.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3dd0140 [0057.008] wnsprintfW (in: pszDest=0x3dd0140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos\\*") returned 41 [0057.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e43d66, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e43d66, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ\x18")) returned 0xffffffff [0057.008] wnsprintfW (in: pszDest=0x3dd0140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Videos\\read_me.txt") returned 51 [0057.008] GetProcessHeap () returned 0x1130000 [0057.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3dd0140 | out: hHeap=0x1130000) returned 1 [0057.008] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 119 [0057.008] GetProcessHeap () returned 0x1130000 [0057.008] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3dc0138 | out: hHeap=0x1130000) returned 1 [0057.008] GetProcessHeap () returned 0x1130000 [0057.008] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.008] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\*") returned 42 [0057.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc98ef1e0, ftCreationTime.dwHighDateTime=0x1d4c859, ftLastAccessTime.dwLowDateTime=0x70350dd0, ftLastAccessTime.dwHighDateTime=0x1d4cd06, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.008] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\.") returned 42 [0057.009] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc98ef1e0, ftCreationTime.dwHighDateTime=0x1d4c859, ftLastAccessTime.dwLowDateTime=0x70350dd0, ftLastAccessTime.dwHighDateTime=0x1d4cd06, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.009] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\..") returned 43 [0057.009] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dfe6da0, ftCreationTime.dwHighDateTime=0x1d4c844, ftLastAccessTime.dwLowDateTime=0x346a2bf0, ftLastAccessTime.dwHighDateTime=0x1d4cd2e, ftLastWriteTime.dwLowDateTime=0x346a2bf0, ftLastWriteTime.dwHighDateTime=0x1d4cd2e, nFileSizeHigh=0x0, nFileSizeLow=0x4c72, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ajKnGRKtqVubjmbQBy.xlsx", cAlternateFileName="AJKNGR~1.XLS")) returned 1 [0057.009] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ajKnGRKtqVubjmbQBy.xlsx") returned 64 [0057.009] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ajKnGRKtqVubjmbQBy.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\ajkngrktqvubjmbqby.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.009] StrStrW (lpFirst="ajKnGRKtqVubjmbQBy.xlsx", lpSrch=".wctc") returned 0x0 [0057.009] GetProcessHeap () returned 0x1130000 [0057.009] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.009] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ajKnGRKtqVubjmbQBy.xlsx.wctc") returned 69 [0057.009] CloseHandle (hObject=0x3c0) returned 1 [0057.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ajKnGRKtqVubjmbQBy.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\ajkngrktqvubjmbqby.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ajKnGRKtqVubjmbQBy.xlsx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\ajkngrktqvubjmbqby.xlsx.wctc")) returned 1 [0057.009] GetProcessHeap () returned 0x1130000 [0057.009] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.009] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 289 [0057.009] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.010] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e43d66, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e43d66, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.010] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\read_me.txt") returned 52 [0057.010] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.010] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.010] GetProcessHeap () returned 0x1130000 [0057.010] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.010] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\wJuiChbkBTXIDE7.docx.wctc") returned 66 [0057.010] CloseHandle (hObject=0x3c0) returned 1 [0057.010] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\wJuiChbkBTXIDE7.docx" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\wjuichbkbtxide7.docx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\wJuiChbkBTXIDE7.docx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\wjuichbkbtxide7.docx.wctc")) returned 1 [0057.011] GetProcessHeap () returned 0x1130000 [0057.011] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.011] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 290 [0057.011] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.011] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f348a0, ftCreationTime.dwHighDateTime=0x1d4d02b, ftLastAccessTime.dwLowDateTime=0x5cf9c9f0, ftLastAccessTime.dwHighDateTime=0x1d4c742, ftLastWriteTime.dwLowDateTime=0x5cf9c9f0, ftLastWriteTime.dwHighDateTime=0x1d4c742, nFileSizeHigh=0x0, nFileSizeLow=0x156be, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ZtcAxHOY4yp46_1sd.doc", cAlternateFileName="ZTCAXH~1.DOC")) returned 1 [0057.011] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ZtcAxHOY4yp46_1sd.doc") returned 62 [0057.011] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ZtcAxHOY4yp46_1sd.doc" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\ztcaxhoy4yp46_1sd.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.011] StrStrW (lpFirst="ZtcAxHOY4yp46_1sd.doc", lpSrch=".wctc") returned 0x0 [0057.011] GetProcessHeap () returned 0x1130000 [0057.011] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.011] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ZtcAxHOY4yp46_1sd.doc.wctc") returned 67 [0057.011] CloseHandle (hObject=0x3c0) returned 1 [0057.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ZtcAxHOY4yp46_1sd.doc" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\ztcaxhoy4yp46_1sd.doc"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\ZtcAxHOY4yp46_1sd.doc.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\nj_yqnraj2\\ztcaxhoy4yp46_1sd.doc.wctc")) returned 1 [0057.011] GetProcessHeap () returned 0x1130000 [0057.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.012] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 291 [0057.012] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.012] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f348a0, ftCreationTime.dwHighDateTime=0x1d4d02b, ftLastAccessTime.dwLowDateTime=0x5cf9c9f0, ftLastAccessTime.dwHighDateTime=0x1d4c742, ftLastWriteTime.dwLowDateTime=0x5cf9c9f0, ftLastWriteTime.dwHighDateTime=0x1d4c742, nFileSizeHigh=0x0, nFileSizeLow=0x156be, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ztcaxhoy4yp46_1sd.doc", cAlternateFileName="ZTCAXH~1.DOC")) returned 0 [0057.012] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.012] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Nj_YqnRaj2\\read_me.txt") returned 52 [0057.012] GetProcessHeap () returned 0x1130000 [0057.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.012] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 120 [0057.012] GetProcessHeap () returned 0x1130000 [0057.012] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3de0148 | out: hHeap=0x1130000) returned 1 [0057.014] GetProcessHeap () returned 0x1130000 [0057.014] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.015] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\*") returned 52 [0057.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f12fc50, ftCreationTime.dwHighDateTime=0x1d4cbf1, ftLastAccessTime.dwLowDateTime=0x78738950, ftLastAccessTime.dwHighDateTime=0x1d4d0b6, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.015] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\.") returned 52 [0057.015] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f12fc50, ftCreationTime.dwHighDateTime=0x1d4cbf1, ftLastAccessTime.dwLowDateTime=0x78738950, ftLastAccessTime.dwHighDateTime=0x1d4d0b6, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.015] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\..") returned 53 [0057.015] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73345270, ftCreationTime.dwHighDateTime=0x1d4cf27, ftLastAccessTime.dwLowDateTime=0xdb454cd0, ftLastAccessTime.dwHighDateTime=0x1d4d075, ftLastWriteTime.dwLowDateTime=0xdb454cd0, ftLastWriteTime.dwHighDateTime=0x1d4d075, nFileSizeHigh=0x0, nFileSizeLow=0xea2a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="h7rQs0F5mPVb.pps", cAlternateFileName="H7RQS0~1.PPS")) returned 1 [0057.015] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\h7rQs0F5mPVb.pps") returned 67 [0057.015] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\h7rQs0F5mPVb.pps" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\h7rqs0f5mpvb.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.015] StrStrW (lpFirst="h7rQs0F5mPVb.pps", lpSrch=".wctc") returned 0x0 [0057.015] GetProcessHeap () returned 0x1130000 [0057.015] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.016] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\h7rQs0F5mPVb.pps.wctc") returned 72 [0057.016] CloseHandle (hObject=0x3c0) returned 1 [0057.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\h7rQs0F5mPVb.pps" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\h7rqs0f5mpvb.pps"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\h7rQs0F5mPVb.pps.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\h7rqs0f5mpvb.pps.wctc")) returned 1 [0057.017] GetProcessHeap () returned 0x1130000 [0057.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.017] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 292 [0057.017] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.017] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe610bd70, ftCreationTime.dwHighDateTime=0x1d4d2b4, ftLastAccessTime.dwLowDateTime=0xfb7d2720, ftLastAccessTime.dwHighDateTime=0x1d4d520, ftLastWriteTime.dwLowDateTime=0xfb7d2720, ftLastWriteTime.dwHighDateTime=0x1d4d520, nFileSizeHigh=0x0, nFileSizeLow=0x16888, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="jUTRo.pdf", cAlternateFileName="")) returned 1 [0057.017] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\jUTRo.pdf") returned 60 [0057.017] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\jUTRo.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\jutro.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.017] StrStrW (lpFirst="jUTRo.pdf", lpSrch=".wctc") returned 0x0 [0057.017] GetProcessHeap () returned 0x1130000 [0057.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.017] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\jUTRo.pdf.wctc") returned 65 [0057.017] CloseHandle (hObject=0x3c0) returned 1 [0057.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\jUTRo.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\jutro.pdf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\jUTRo.pdf.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\jutro.pdf.wctc")) returned 1 [0057.018] GetProcessHeap () returned 0x1130000 [0057.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.018] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 293 [0057.018] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.018] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7efd50, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0x6ba1d9a0, ftLastAccessTime.dwHighDateTime=0x1d4c7ee, ftLastWriteTime.dwLowDateTime=0x6ba1d9a0, ftLastWriteTime.dwHighDateTime=0x1d4c7ee, nFileSizeHigh=0x0, nFileSizeLow=0x4a6d, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="KFF f.xlsx", cAlternateFileName="KFFF~1.XLS")) returned 1 [0057.018] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\KFF f.xlsx") returned 61 [0057.018] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\KFF f.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\kff f.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.018] StrStrW (lpFirst="KFF f.xlsx", lpSrch=".wctc") returned 0x0 [0057.018] GetProcessHeap () returned 0x1130000 [0057.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.018] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\KFF f.xlsx.wctc") returned 66 [0057.018] CloseHandle (hObject=0x3c0) returned 1 [0057.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\KFF f.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\kff f.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\KFF f.xlsx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\kff f.xlsx.wctc")) returned 1 [0057.018] GetProcessHeap () returned 0x1130000 [0057.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.019] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 294 [0057.019] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.019] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea76fd30, ftCreationTime.dwHighDateTime=0x1d4cfd4, ftLastAccessTime.dwLowDateTime=0x17733f70, ftLastAccessTime.dwHighDateTime=0x1d4c64c, ftLastWriteTime.dwLowDateTime=0x17733f70, ftLastWriteTime.dwHighDateTime=0x1d4c64c, nFileSizeHigh=0x0, nFileSizeLow=0xa3a0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="lebBcL6nPtcLVBR.ppt", cAlternateFileName="LEBBCL~1.PPT")) returned 1 [0057.019] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\lebBcL6nPtcLVBR.ppt") returned 70 [0057.019] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\lebBcL6nPtcLVBR.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\lebbcl6nptclvbr.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.019] StrStrW (lpFirst="lebBcL6nPtcLVBR.ppt", lpSrch=".wctc") returned 0x0 [0057.019] GetProcessHeap () returned 0x1130000 [0057.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.019] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\lebBcL6nPtcLVBR.ppt.wctc") returned 75 [0057.019] CloseHandle (hObject=0x3c0) returned 1 [0057.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\lebBcL6nPtcLVBR.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\lebbcl6nptclvbr.ppt"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\lebBcL6nPtcLVBR.ppt.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\lebbcl6nptclvbr.ppt.wctc")) returned 1 [0057.019] GetProcessHeap () returned 0x1130000 [0057.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.019] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 295 [0057.019] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.019] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb919dfb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc4d033a0, ftLastAccessTime.dwHighDateTime=0x1d4d0a4, ftLastWriteTime.dwLowDateTime=0xc4d033a0, ftLastWriteTime.dwHighDateTime=0x1d4d0a4, nFileSizeHigh=0x0, nFileSizeLow=0x11f64, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="LRFJE5t5vkQqS_JjJ4Ho.pptx", cAlternateFileName="LRFJE5~1.PPT")) returned 1 [0057.019] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\LRFJE5t5vkQqS_JjJ4Ho.pptx") returned 76 [0057.020] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\LRFJE5t5vkQqS_JjJ4Ho.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\lrfje5t5vkqqs_jjj4ho.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.020] StrStrW (lpFirst="LRFJE5t5vkQqS_JjJ4Ho.pptx", lpSrch=".wctc") returned 0x0 [0057.020] GetProcessHeap () returned 0x1130000 [0057.020] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.020] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\LRFJE5t5vkQqS_JjJ4Ho.pptx.wctc") returned 81 [0057.020] CloseHandle (hObject=0x3c0) returned 1 [0057.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\LRFJE5t5vkQqS_JjJ4Ho.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\lrfje5t5vkqqs_jjj4ho.pptx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\LRFJE5t5vkQqS_JjJ4Ho.pptx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\lrfje5t5vkqqs_jjj4ho.pptx.wctc")) returned 1 [0057.020] GetProcessHeap () returned 0x1130000 [0057.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.020] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 296 [0057.020] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.020] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9cb9c0, ftCreationTime.dwHighDateTime=0x1d4c968, ftLastAccessTime.dwLowDateTime=0x7fda5660, ftLastAccessTime.dwHighDateTime=0x1d4ca8a, ftLastWriteTime.dwLowDateTime=0x7fda5660, ftLastWriteTime.dwHighDateTime=0x1d4ca8a, nFileSizeHigh=0x0, nFileSizeLow=0xfc9b, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="MvvfS10AO5hL9P.pps", cAlternateFileName="MVVFS1~1.PPS")) returned 1 [0057.020] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\MvvfS10AO5hL9P.pps") returned 69 [0057.020] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\MvvfS10AO5hL9P.pps" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\mvvfs10ao5hl9p.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.020] StrStrW (lpFirst="MvvfS10AO5hL9P.pps", lpSrch=".wctc") returned 0x0 [0057.021] GetProcessHeap () returned 0x1130000 [0057.021] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.021] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\MvvfS10AO5hL9P.pps.wctc") returned 74 [0057.021] CloseHandle (hObject=0x3c0) returned 1 [0057.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\MvvfS10AO5hL9P.pps" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\mvvfs10ao5hl9p.pps"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\MvvfS10AO5hL9P.pps.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\mvvfs10ao5hl9p.pps.wctc")) returned 1 [0057.021] GetProcessHeap () returned 0x1130000 [0057.021] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.021] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 297 [0057.021] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.021] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1be2bc0, ftCreationTime.dwHighDateTime=0x1d4cb8d, ftLastAccessTime.dwLowDateTime=0xa4447fc0, ftLastAccessTime.dwHighDateTime=0x1d4c892, ftLastWriteTime.dwLowDateTime=0xa4447fc0, ftLastWriteTime.dwHighDateTime=0x1d4c892, nFileSizeHigh=0x0, nFileSizeLow=0xe21a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="NxFf5U4rM.csv", cAlternateFileName="NXFF5U~1.CSV")) returned 1 [0057.021] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\NxFf5U4rM.csv") returned 64 [0057.021] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\NxFf5U4rM.csv" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\nxff5u4rm.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.021] StrStrW (lpFirst="NxFf5U4rM.csv", lpSrch=".wctc") returned 0x0 [0057.021] GetProcessHeap () returned 0x1130000 [0057.021] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.021] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\NxFf5U4rM.csv.wctc") returned 69 [0057.021] CloseHandle (hObject=0x3c0) returned 1 [0057.022] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\NxFf5U4rM.csv" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\nxff5u4rm.csv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\NxFf5U4rM.csv.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\nxff5u4rm.csv.wctc")) returned 1 [0057.022] GetProcessHeap () returned 0x1130000 [0057.022] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.022] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 298 [0057.022] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.022] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e43d66, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e43d66, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e43d66, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.022] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\read_me.txt") returned 62 [0057.022] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.022] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.022] GetProcessHeap () returned 0x1130000 [0057.022] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.022] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\VW0vNzwrr_xZ4EMBgK.odp.wctc") returned 78 [0057.022] CloseHandle (hObject=0x3c0) returned 1 [0057.022] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\VW0vNzwrr_xZ4EMBgK.odp" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\vw0vnzwrr_xz4embgk.odp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\VW0vNzwrr_xZ4EMBgK.odp.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\odxeglucjb3vxt6qfqgy\\vw0vnzwrr_xz4embgk.odp.wctc")) returned 1 [0057.023] GetProcessHeap () returned 0x1130000 [0057.023] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.023] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 299 [0057.023] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.023] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da92c70, ftCreationTime.dwHighDateTime=0x1d4ced3, ftLastAccessTime.dwLowDateTime=0xa9c527e0, ftLastAccessTime.dwHighDateTime=0x1d4cc4f, ftLastWriteTime.dwLowDateTime=0xa9c527e0, ftLastWriteTime.dwHighDateTime=0x1d4cc4f, nFileSizeHigh=0x0, nFileSizeLow=0x6303, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="vw0vnzwrr_xz4embgk.odp", cAlternateFileName="VW0VNZ~1.ODP")) returned 0 [0057.023] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.023] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\ODxegLUCjB3vxT6qFqgY\\read_me.txt") returned 62 [0057.023] GetProcessHeap () returned 0x1130000 [0057.023] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.023] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 121 [0057.023] GetProcessHeap () returned 0x1130000 [0057.023] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3df0150 | out: hHeap=0x1130000) returned 1 [0057.024] GetProcessHeap () returned 0x1130000 [0057.024] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.024] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*") returned 45 [0057.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.025] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\.") returned 45 [0057.025] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.025] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\..") returned 46 [0057.025] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0057.025] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned 60 [0057.025] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.025] StrStrW (lpFirst="kkcie@kdj.kd.pst", lpSrch=".wctc") returned 0x0 [0057.025] GetProcessHeap () returned 0x1130000 [0057.025] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.025] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.wctc") returned 65 [0057.025] CloseHandle (hObject=0x3c0) returned 1 [0057.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.wctc")) returned 1 [0057.058] GetProcessHeap () returned 0x1130000 [0057.058] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.058] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 300 [0057.058] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.058] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e69f6f, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e69f6f, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.058] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\read_me.txt") returned 55 [0057.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\Outlook Files\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.058] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.058] GetProcessHeap () returned 0x1130000 [0057.058] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.058] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 122 [0057.058] GetProcessHeap () returned 0x1130000 [0057.058] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e00158 | out: hHeap=0x1130000) returned 1 [0057.060] GetProcessHeap () returned 0x1130000 [0057.060] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.060] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\*") returned 36 [0057.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d2f2080, ftCreationTime.dwHighDateTime=0x1d4cb35, ftLastAccessTime.dwLowDateTime=0x313259c0, ftLastAccessTime.dwHighDateTime=0x1d4cc8f, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.060] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\.") returned 36 [0057.060] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d2f2080, ftCreationTime.dwHighDateTime=0x1d4cb35, ftLastAccessTime.dwLowDateTime=0x313259c0, ftLastAccessTime.dwHighDateTime=0x1d4cc8f, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.060] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\..") returned 37 [0057.061] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92b83d60, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x976f4c0, ftLastAccessTime.dwHighDateTime=0x1d4c5cf, ftLastWriteTime.dwLowDateTime=0x976f4c0, ftLastWriteTime.dwHighDateTime=0x1d4c5cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="hIDeDKWHFj4z", cAlternateFileName="HIDEDK~1")) returned 1 [0057.061] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z") returned 47 [0057.061] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacdd4d10, ftCreationTime.dwHighDateTime=0x1d4c9cd, ftLastAccessTime.dwLowDateTime=0xdbdc6920, ftLastAccessTime.dwHighDateTime=0x1d4cd06, ftLastWriteTime.dwLowDateTime=0xdbdc6920, ftLastWriteTime.dwHighDateTime=0x1d4cd06, nFileSizeHigh=0x0, nFileSizeLow=0x13682, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="JINhV3bKZrGfQ.pdf", cAlternateFileName="JINHV3~1.PDF")) returned 1 [0057.061] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\JINhV3bKZrGfQ.pdf") returned 52 [0057.061] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\JINhV3bKZrGfQ.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\jinhv3bkzrgfq.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.061] StrStrW (lpFirst="JINhV3bKZrGfQ.pdf", lpSrch=".wctc") returned 0x0 [0057.061] GetProcessHeap () returned 0x1130000 [0057.061] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.061] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\JINhV3bKZrGfQ.pdf.wctc") returned 57 [0057.061] CloseHandle (hObject=0x3c0) returned 1 [0057.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\JINhV3bKZrGfQ.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\jinhv3bkzrgfq.pdf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\JINhV3bKZrGfQ.pdf.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\jinhv3bkzrgfq.pdf.wctc")) returned 1 [0057.062] GetProcessHeap () returned 0x1130000 [0057.062] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.062] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 301 [0057.062] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.062] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf88cef0, ftCreationTime.dwHighDateTime=0x1d4d39a, ftLastAccessTime.dwLowDateTime=0xae91430, ftLastAccessTime.dwHighDateTime=0x1d4c644, ftLastWriteTime.dwLowDateTime=0xae91430, ftLastWriteTime.dwHighDateTime=0x1d4c644, nFileSizeHigh=0x0, nFileSizeLow=0x6ca3, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Nj_KHs-7kEeW2L98.ods", cAlternateFileName="NJ_KHS~1.ODS")) returned 1 [0057.062] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\Nj_KHs-7kEeW2L98.ods") returned 55 [0057.062] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\Nj_KHs-7kEeW2L98.ods" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\nj_khs-7keew2l98.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.062] StrStrW (lpFirst="Nj_KHs-7kEeW2L98.ods", lpSrch=".wctc") returned 0x0 [0057.062] GetProcessHeap () returned 0x1130000 [0057.062] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.062] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\Nj_KHs-7kEeW2L98.ods.wctc") returned 60 [0057.062] CloseHandle (hObject=0x3c0) returned 1 [0057.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\Nj_KHs-7kEeW2L98.ods" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\nj_khs-7keew2l98.ods"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\Nj_KHs-7kEeW2L98.ods.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\nj_khs-7keew2l98.ods.wctc")) returned 1 [0057.063] GetProcessHeap () returned 0x1130000 [0057.063] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.063] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 302 [0057.063] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.063] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e69f6f, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e69f6f, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.063] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\read_me.txt") returned 46 [0057.063] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.063] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.063] GetProcessHeap () returned 0x1130000 [0057.063] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.063] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\Vg6D.csv.wctc") returned 48 [0057.063] CloseHandle (hObject=0x3c0) returned 1 [0057.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\Vg6D.csv" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\vg6d.csv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\Vg6D.csv.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\vg6d.csv.wctc")) returned 1 [0057.064] GetProcessHeap () returned 0x1130000 [0057.064] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.064] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 303 [0057.064] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.072] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2562d0, ftCreationTime.dwHighDateTime=0x1d4c6fc, ftLastAccessTime.dwLowDateTime=0x62188c30, ftLastAccessTime.dwHighDateTime=0x1d4d103, ftLastWriteTime.dwLowDateTime=0x62188c30, ftLastWriteTime.dwHighDateTime=0x1d4d103, nFileSizeHigh=0x0, nFileSizeLow=0x15e48, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="vg6d.csv", cAlternateFileName="")) returned 0 [0057.072] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0057.072] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\read_me.txt") returned 46 [0057.072] GetProcessHeap () returned 0x1130000 [0057.072] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.074] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 124 [0057.074] GetProcessHeap () returned 0x1130000 [0057.074] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e10160 | out: hHeap=0x1130000) returned 1 [0057.074] GetProcessHeap () returned 0x1130000 [0057.074] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.076] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\*") returned 40 [0057.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39b3eb0, ftCreationTime.dwHighDateTime=0x1d4cbb2, ftLastAccessTime.dwLowDateTime=0x113e4eb0, ftLastAccessTime.dwHighDateTime=0x1d4cfc5, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0057.076] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\.") returned 40 [0057.076] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39b3eb0, ftCreationTime.dwHighDateTime=0x1d4cbb2, ftLastAccessTime.dwLowDateTime=0x113e4eb0, ftLastAccessTime.dwHighDateTime=0x1d4cfc5, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.076] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\..") returned 41 [0057.076] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x356420a0, ftCreationTime.dwHighDateTime=0x1d4d081, ftLastAccessTime.dwLowDateTime=0xb4de29d0, ftLastAccessTime.dwHighDateTime=0x1d4d350, ftLastWriteTime.dwLowDateTime=0xb4de29d0, ftLastWriteTime.dwHighDateTime=0x1d4d350, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="7_V10g7t2YlS2cpn", cAlternateFileName="7_V10G~1")) returned 1 [0057.076] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn") returned 55 [0057.076] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc875a720, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x2f226540, ftLastAccessTime.dwHighDateTime=0x1d4d481, ftLastWriteTime.dwLowDateTime=0x2f226540, ftLastWriteTime.dwHighDateTime=0x1d4d481, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="h9sKpMkAZwo9DO2y-", cAlternateFileName="H9SKPM~1")) returned 1 [0057.076] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-") returned 56 [0057.076] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e88310, ftCreationTime.dwHighDateTime=0x1d4c990, ftLastAccessTime.dwLowDateTime=0xcd4cf150, ftLastAccessTime.dwHighDateTime=0x1d4d0ca, ftLastWriteTime.dwLowDateTime=0xcd4cf150, ftLastWriteTime.dwHighDateTime=0x1d4d0ca, nFileSizeHigh=0x0, nFileSizeLow=0x4445, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="i85Vi9URVgLWAZT.csv", cAlternateFileName="I85VI9~1.CSV")) returned 1 [0057.076] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\i85Vi9URVgLWAZT.csv") returned 58 [0057.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\i85Vi9URVgLWAZT.csv" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\i85vi9urvglwazt.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.076] StrStrW (lpFirst="i85Vi9URVgLWAZT.csv", lpSrch=".wctc") returned 0x0 [0057.076] GetProcessHeap () returned 0x1130000 [0057.076] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e30170 [0057.077] wnsprintfW (in: pszDest=0x3e30170, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\i85Vi9URVgLWAZT.csv.wctc") returned 63 [0057.077] CloseHandle (hObject=0x3c0) returned 1 [0057.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\i85Vi9URVgLWAZT.csv" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\i85vi9urvglwazt.csv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\i85Vi9URVgLWAZT.csv.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\i85vi9urvglwazt.csv.wctc")) returned 1 [0057.078] GetProcessHeap () returned 0x1130000 [0057.078] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e30170 | out: hHeap=0x1130000) returned 1 [0057.078] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 306 [0057.078] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.078] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c32ce80, ftCreationTime.dwHighDateTime=0x1d4cb01, ftLastAccessTime.dwLowDateTime=0x21520, ftLastAccessTime.dwHighDateTime=0x1d4d383, ftLastWriteTime.dwLowDateTime=0x21520, ftLastWriteTime.dwHighDateTime=0x1d4d383, nFileSizeHigh=0x0, nFileSizeLow=0x1456e, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="KJVz.odt", cAlternateFileName="")) returned 1 [0057.078] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\KJVz.odt") returned 47 [0057.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\KJVz.odt" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\kjvz.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.078] StrStrW (lpFirst="KJVz.odt", lpSrch=".wctc") returned 0x0 [0057.078] GetProcessHeap () returned 0x1130000 [0057.078] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e30170 [0057.078] wnsprintfW (in: pszDest=0x3e30170, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\KJVz.odt.wctc") returned 52 [0057.078] CloseHandle (hObject=0x3c0) returned 1 [0057.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\KJVz.odt" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\kjvz.odt"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\KJVz.odt.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\kjvz.odt.wctc")) returned 1 [0057.079] GetProcessHeap () returned 0x1130000 [0057.079] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e30170 | out: hHeap=0x1130000) returned 1 [0057.079] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 307 [0057.079] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.079] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d5f20, ftCreationTime.dwHighDateTime=0x1d4d4c2, ftLastAccessTime.dwLowDateTime=0x6622f420, ftLastAccessTime.dwHighDateTime=0x1d4c67f, ftLastWriteTime.dwLowDateTime=0x6622f420, ftLastWriteTime.dwHighDateTime=0x1d4c67f, nFileSizeHigh=0x0, nFileSizeLow=0xdd1b, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="pob__6ferHHf.ods", cAlternateFileName="POB__6~1.ODS")) returned 1 [0057.079] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\pob__6ferHHf.ods") returned 55 [0057.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\pob__6ferHHf.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\pob__6ferhhf.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.079] StrStrW (lpFirst="pob__6ferHHf.ods", lpSrch=".wctc") returned 0x0 [0057.079] GetProcessHeap () returned 0x1130000 [0057.079] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e30170 [0057.079] wnsprintfW (in: pszDest=0x3e30170, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\pob__6ferHHf.ods.wctc") returned 60 [0057.079] CloseHandle (hObject=0x3c0) returned 1 [0057.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\pob__6ferHHf.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\pob__6ferhhf.ods"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\pob__6ferHHf.ods.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\pob__6ferhhf.ods.wctc")) returned 1 [0057.079] GetProcessHeap () returned 0x1130000 [0057.079] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e30170 | out: hHeap=0x1130000) returned 1 [0057.080] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 308 [0057.080] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.080] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb667b, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fb667b, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.080] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\read_me.txt") returned 50 [0057.080] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.080] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.080] GetProcessHeap () returned 0x1130000 [0057.080] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e30170 [0057.080] wnsprintfW (in: pszDest=0x3e30170, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\U p5MnTJL5.docx.wctc") returned 59 [0057.080] CloseHandle (hObject=0x3c0) returned 1 [0057.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\U p5MnTJL5.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\u p5mntjl5.docx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\U p5MnTJL5.docx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\u p5mntjl5.docx.wctc")) returned 1 [0057.080] GetProcessHeap () returned 0x1130000 [0057.080] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e30170 | out: hHeap=0x1130000) returned 1 [0057.080] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 309 [0057.080] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.080] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x874f2a40, ftCreationTime.dwHighDateTime=0x1d4cd7f, ftLastAccessTime.dwLowDateTime=0x87ab7d0, ftLastAccessTime.dwHighDateTime=0x1d4cd8d, ftLastWriteTime.dwLowDateTime=0x87ab7d0, ftLastWriteTime.dwHighDateTime=0x1d4cd8d, nFileSizeHigh=0x0, nFileSizeLow=0x8525, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="yS9lXh1.doc", cAlternateFileName="")) returned 1 [0057.081] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\yS9lXh1.doc") returned 50 [0057.081] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\yS9lXh1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\ys9lxh1.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.081] StrStrW (lpFirst="yS9lXh1.doc", lpSrch=".wctc") returned 0x0 [0057.081] GetProcessHeap () returned 0x1130000 [0057.081] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e30170 [0057.081] wnsprintfW (in: pszDest=0x3e30170, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\yS9lXh1.doc.wctc") returned 55 [0057.081] CloseHandle (hObject=0x3c0) returned 1 [0057.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\yS9lXh1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\ys9lxh1.doc"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\yS9lXh1.doc.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\ys9lxh1.doc.wctc")) returned 1 [0057.081] GetProcessHeap () returned 0x1130000 [0057.081] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e30170 | out: hHeap=0x1130000) returned 1 [0057.081] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 310 [0057.081] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.081] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x874f2a40, ftCreationTime.dwHighDateTime=0x1d4cd7f, ftLastAccessTime.dwLowDateTime=0x87ab7d0, ftLastAccessTime.dwHighDateTime=0x1d4cd8d, ftLastWriteTime.dwLowDateTime=0x87ab7d0, ftLastWriteTime.dwHighDateTime=0x1d4cd8d, nFileSizeHigh=0x0, nFileSizeLow=0x8525, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ys9lxh1.doc", cAlternateFileName="")) returned 0 [0057.081] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0057.082] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\read_me.txt") returned 50 [0057.082] GetProcessHeap () returned 0x1130000 [0057.082] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.082] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 125 [0057.082] GetProcessHeap () returned 0x1130000 [0057.082] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e20168 | out: hHeap=0x1130000) returned 1 [0057.082] GetProcessHeap () returned 0x1130000 [0057.082] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.082] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\*") returned 57 [0057.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x356420a0, ftCreationTime.dwHighDateTime=0x1d4d081, ftLastAccessTime.dwLowDateTime=0xb4de29d0, ftLastAccessTime.dwHighDateTime=0x1d4d350, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.082] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\.") returned 57 [0057.082] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x356420a0, ftCreationTime.dwHighDateTime=0x1d4d081, ftLastAccessTime.dwLowDateTime=0xb4de29d0, ftLastAccessTime.dwHighDateTime=0x1d4d350, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.082] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\..") returned 58 [0057.082] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb00ec0, ftCreationTime.dwHighDateTime=0x1d4ca5e, ftLastAccessTime.dwLowDateTime=0x72b549b0, ftLastAccessTime.dwHighDateTime=0x1d4d451, ftLastWriteTime.dwLowDateTime=0x72b549b0, ftLastWriteTime.dwHighDateTime=0x1d4d451, nFileSizeHigh=0x0, nFileSizeLow=0x13a04, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="4ynuE f8G.ods", cAlternateFileName="4YNUEF~1.ODS")) returned 1 [0057.082] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\4ynuE f8G.ods") returned 69 [0057.082] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\4ynuE f8G.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\4ynue f8g.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.082] StrStrW (lpFirst="4ynuE f8G.ods", lpSrch=".wctc") returned 0x0 [0057.082] GetProcessHeap () returned 0x1130000 [0057.082] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.083] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\4ynuE f8G.ods.wctc") returned 74 [0057.083] CloseHandle (hObject=0x3c0) returned 1 [0057.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\4ynuE f8G.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\4ynue f8g.ods"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\4ynuE f8G.ods.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\4ynue f8g.ods.wctc")) returned 1 [0057.084] GetProcessHeap () returned 0x1130000 [0057.084] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.084] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 311 [0057.084] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.084] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68cc13e0, ftCreationTime.dwHighDateTime=0x1d4cebe, ftLastAccessTime.dwLowDateTime=0xedf74460, ftLastAccessTime.dwHighDateTime=0x1d4c7ff, ftLastWriteTime.dwLowDateTime=0xedf74460, ftLastWriteTime.dwHighDateTime=0x1d4c7ff, nFileSizeHigh=0x0, nFileSizeLow=0x1b61, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="BSjI.doc", cAlternateFileName="")) returned 1 [0057.084] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\BSjI.doc") returned 64 [0057.084] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\BSjI.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\bsji.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.084] StrStrW (lpFirst="BSjI.doc", lpSrch=".wctc") returned 0x0 [0057.084] GetProcessHeap () returned 0x1130000 [0057.084] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.084] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\BSjI.doc.wctc") returned 69 [0057.084] CloseHandle (hObject=0x3c0) returned 1 [0057.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\BSjI.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\bsji.doc"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\BSjI.doc.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\bsji.doc.wctc")) returned 1 [0057.085] GetProcessHeap () returned 0x1130000 [0057.085] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.085] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 312 [0057.085] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.085] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf60ae780, ftCreationTime.dwHighDateTime=0x1d4c90b, ftLastAccessTime.dwLowDateTime=0xfee3ff60, ftLastAccessTime.dwHighDateTime=0x1d4cb89, ftLastWriteTime.dwLowDateTime=0xfee3ff60, ftLastWriteTime.dwHighDateTime=0x1d4cb89, nFileSizeHigh=0x0, nFileSizeLow=0x177bd, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="eGFAB.rtf", cAlternateFileName="")) returned 1 [0057.085] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\eGFAB.rtf") returned 65 [0057.085] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\eGFAB.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\egfab.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.085] StrStrW (lpFirst="eGFAB.rtf", lpSrch=".wctc") returned 0x0 [0057.085] GetProcessHeap () returned 0x1130000 [0057.085] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.085] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\eGFAB.rtf.wctc") returned 70 [0057.085] CloseHandle (hObject=0x3c0) returned 1 [0057.085] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\eGFAB.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\egfab.rtf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\eGFAB.rtf.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\egfab.rtf.wctc")) returned 1 [0057.085] GetProcessHeap () returned 0x1130000 [0057.085] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.085] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 313 [0057.086] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.086] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e69f6f, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e69f6f, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.086] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\read_me.txt") returned 67 [0057.086] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.086] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.086] GetProcessHeap () returned 0x1130000 [0057.086] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.086] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\RGD5205haSjdKZe7kiyE.csv.wctc") returned 85 [0057.086] CloseHandle (hObject=0x3c0) returned 1 [0057.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\RGD5205haSjdKZe7kiyE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\rgd5205hasjdkze7kiye.csv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\RGD5205haSjdKZe7kiyE.csv.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\rgd5205hasjdkze7kiye.csv.wctc")) returned 1 [0057.086] GetProcessHeap () returned 0x1130000 [0057.086] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.086] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 314 [0057.087] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.087] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c1db0, ftCreationTime.dwHighDateTime=0x1d4d16b, ftLastAccessTime.dwLowDateTime=0x681cdcb0, ftLastAccessTime.dwHighDateTime=0x1d4cacf, ftLastWriteTime.dwLowDateTime=0x681cdcb0, ftLastWriteTime.dwHighDateTime=0x1d4cacf, nFileSizeHigh=0x0, nFileSizeLow=0x23e0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="TkpzdMXAXtUkBtKche3D.pdf", cAlternateFileName="TKPZDM~1.PDF")) returned 1 [0057.087] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\TkpzdMXAXtUkBtKche3D.pdf") returned 80 [0057.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\TkpzdMXAXtUkBtKche3D.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\tkpzdmxaxtukbtkche3d.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.087] StrStrW (lpFirst="TkpzdMXAXtUkBtKche3D.pdf", lpSrch=".wctc") returned 0x0 [0057.087] GetProcessHeap () returned 0x1130000 [0057.087] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.087] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\TkpzdMXAXtUkBtKche3D.pdf.wctc") returned 85 [0057.087] CloseHandle (hObject=0x3c0) returned 1 [0057.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\TkpzdMXAXtUkBtKche3D.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\tkpzdmxaxtukbtkche3d.pdf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\TkpzdMXAXtUkBtKche3D.pdf.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\7_v10g7t2yls2cpn\\tkpzdmxaxtukbtkche3d.pdf.wctc")) returned 1 [0057.087] GetProcessHeap () returned 0x1130000 [0057.087] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.087] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 315 [0057.087] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.087] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c1db0, ftCreationTime.dwHighDateTime=0x1d4d16b, ftLastAccessTime.dwLowDateTime=0x681cdcb0, ftLastAccessTime.dwHighDateTime=0x1d4cacf, ftLastWriteTime.dwLowDateTime=0x681cdcb0, ftLastWriteTime.dwHighDateTime=0x1d4cacf, nFileSizeHigh=0x0, nFileSizeLow=0x23e0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="tkpzdmxaxtukbtkche3d.pdf", cAlternateFileName="TKPZDM~1.PDF")) returned 0 [0057.088] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0057.088] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\7_V10g7t2YlS2cpn\\read_me.txt") returned 67 [0057.088] GetProcessHeap () returned 0x1130000 [0057.088] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.088] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 126 [0057.088] GetProcessHeap () returned 0x1130000 [0057.088] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e50180 | out: hHeap=0x1130000) returned 1 [0057.088] GetProcessHeap () returned 0x1130000 [0057.088] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e50180 [0057.088] wnsprintfW (in: pszDest=0x3e50180, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\*") returned 58 [0057.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc875a720, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x2f226540, ftLastAccessTime.dwHighDateTime=0x1d4d481, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0057.088] wnsprintfW (in: pszDest=0x3e50180, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\.") returned 58 [0057.088] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc875a720, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x2f226540, ftLastAccessTime.dwHighDateTime=0x1d4d481, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.088] wnsprintfW (in: pszDest=0x3e50180, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\..") returned 59 [0057.088] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a47d5d0, ftCreationTime.dwHighDateTime=0x1d4cf6b, ftLastAccessTime.dwLowDateTime=0xa9b4e8a0, ftLastAccessTime.dwHighDateTime=0x1d4d4bd, ftLastWriteTime.dwLowDateTime=0xa9b4e8a0, ftLastWriteTime.dwHighDateTime=0x1d4d4bd, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="1iD v9_Q0aUQ.ots", cAlternateFileName="1IDV9_~1.OTS")) returned 1 [0057.088] wnsprintfW (in: pszDest=0x3e50180, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\1iD v9_Q0aUQ.ots") returned 73 [0057.088] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\1iD v9_Q0aUQ.ots" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\1id v9_q0auq.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.088] StrStrW (lpFirst="1iD v9_Q0aUQ.ots", lpSrch=".wctc") returned 0x0 [0057.088] GetProcessHeap () returned 0x1130000 [0057.088] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.088] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\1iD v9_Q0aUQ.ots.wctc") returned 78 [0057.088] CloseHandle (hObject=0x3c0) returned 1 [0057.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\1iD v9_Q0aUQ.ots" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\1id v9_q0auq.ots"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\1iD v9_Q0aUQ.ots.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\1id v9_q0auq.ots.wctc")) returned 1 [0057.089] GetProcessHeap () returned 0x1130000 [0057.089] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.089] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 316 [0057.089] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.089] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf717b080, ftCreationTime.dwHighDateTime=0x1d4d046, ftLastAccessTime.dwLowDateTime=0x62c7f230, ftLastAccessTime.dwHighDateTime=0x1d4d2c8, ftLastWriteTime.dwLowDateTime=0x62c7f230, ftLastWriteTime.dwHighDateTime=0x1d4d2c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="cEN69gCeZ75mL9uAJ", cAlternateFileName="CEN69G~1")) returned 1 [0057.089] wnsprintfW (in: pszDest=0x3e50180, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ") returned 74 [0057.089] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29abcbc0, ftCreationTime.dwHighDateTime=0x1d4cfb2, ftLastAccessTime.dwLowDateTime=0xa92c5af0, ftLastAccessTime.dwHighDateTime=0x1d4d18c, ftLastWriteTime.dwLowDateTime=0xa92c5af0, ftLastWriteTime.dwHighDateTime=0x1d4d18c, nFileSizeHigh=0x0, nFileSizeLow=0x5df2, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ikVC5h.xls", cAlternateFileName="")) returned 1 [0057.089] wnsprintfW (in: pszDest=0x3e50180, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\ikVC5h.xls") returned 67 [0057.089] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\ikVC5h.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\ikvc5h.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.089] StrStrW (lpFirst="ikVC5h.xls", lpSrch=".wctc") returned 0x0 [0057.089] GetProcessHeap () returned 0x1130000 [0057.089] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.089] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\ikVC5h.xls.wctc") returned 72 [0057.089] CloseHandle (hObject=0x3c0) returned 1 [0057.090] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\ikVC5h.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\ikvc5h.xls"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\ikVC5h.xls.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\ikvc5h.xls.wctc")) returned 1 [0057.090] GetProcessHeap () returned 0x1130000 [0057.090] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.090] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 317 [0057.090] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.090] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e92372, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e92372, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.090] wnsprintfW (in: pszDest=0x3e50180, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\read_me.txt") returned 68 [0057.090] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.090] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.090] GetProcessHeap () returned 0x1130000 [0057.090] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.090] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\uIxokILYJXqSor.ods.wctc") returned 80 [0057.090] CloseHandle (hObject=0x3c0) returned 1 [0057.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\uIxokILYJXqSor.ods" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\uixokilyjxqsor.ods"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\uIxokILYJXqSor.ods.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\uixokilyjxqsor.ods.wctc")) returned 1 [0057.091] GetProcessHeap () returned 0x1130000 [0057.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.091] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 318 [0057.091] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.091] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5db5740, ftCreationTime.dwHighDateTime=0x1d4d0f4, ftLastAccessTime.dwLowDateTime=0xd6e84730, ftLastAccessTime.dwHighDateTime=0x1d4cb86, ftLastWriteTime.dwLowDateTime=0xd6e84730, ftLastWriteTime.dwHighDateTime=0x1d4cb86, nFileSizeHigh=0x0, nFileSizeLow=0x124d6, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="uixokilyjxqsor.ods", cAlternateFileName="UIXOKI~1.ODS")) returned 0 [0057.091] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0057.091] wnsprintfW (in: pszDest=0x3e50180, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\read_me.txt") returned 68 [0057.091] GetProcessHeap () returned 0x1130000 [0057.091] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e50180 | out: hHeap=0x1130000) returned 1 [0057.091] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 127 [0057.092] GetProcessHeap () returned 0x1130000 [0057.092] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e60188 | out: hHeap=0x1130000) returned 1 [0057.094] GetProcessHeap () returned 0x1130000 [0057.094] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.094] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\*") returned 76 [0057.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf717b080, ftCreationTime.dwHighDateTime=0x1d4d046, ftLastAccessTime.dwLowDateTime=0x62c7f230, ftLastAccessTime.dwHighDateTime=0x1d4d2c8, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0057.095] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\.") returned 76 [0057.095] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf717b080, ftCreationTime.dwHighDateTime=0x1d4d046, ftLastAccessTime.dwLowDateTime=0x62c7f230, ftLastAccessTime.dwHighDateTime=0x1d4d2c8, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.095] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\..") returned 77 [0057.095] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609c9c70, ftCreationTime.dwHighDateTime=0x1d4cd93, ftLastAccessTime.dwLowDateTime=0x3446d110, ftLastAccessTime.dwHighDateTime=0x1d4c77e, ftLastWriteTime.dwLowDateTime=0x3446d110, ftLastWriteTime.dwHighDateTime=0x1d4c77e, nFileSizeHigh=0x0, nFileSizeLow=0x18f3c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="B SjloGTaky6WQ.pps", cAlternateFileName="BSJLOG~1.PPS")) returned 1 [0057.095] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\B SjloGTaky6WQ.pps") returned 93 [0057.095] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\B SjloGTaky6WQ.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\b sjlogtaky6wq.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.095] StrStrW (lpFirst="B SjloGTaky6WQ.pps", lpSrch=".wctc") returned 0x0 [0057.095] GetProcessHeap () returned 0x1130000 [0057.095] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.096] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\B SjloGTaky6WQ.pps.wctc") returned 98 [0057.096] CloseHandle (hObject=0x3c0) returned 1 [0057.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\B SjloGTaky6WQ.pps" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\b sjlogtaky6wq.pps"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\B SjloGTaky6WQ.pps.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\b sjlogtaky6wq.pps.wctc")) returned 1 [0057.096] GetProcessHeap () returned 0x1130000 [0057.096] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.096] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 319 [0057.097] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.097] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745dc4c0, ftCreationTime.dwHighDateTime=0x1d4d23c, ftLastAccessTime.dwLowDateTime=0xa7780cb0, ftLastAccessTime.dwHighDateTime=0x1d4d1b7, ftLastWriteTime.dwLowDateTime=0xa7780cb0, ftLastWriteTime.dwHighDateTime=0x1d4d1b7, nFileSizeHigh=0x0, nFileSizeLow=0x12c81, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="iAyvFJ4shU3FNA4LhgO.pdf", cAlternateFileName="IAYVFJ~1.PDF")) returned 1 [0057.097] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\iAyvFJ4shU3FNA4LhgO.pdf") returned 98 [0057.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\iAyvFJ4shU3FNA4LhgO.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\iayvfj4shu3fna4lhgo.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.097] StrStrW (lpFirst="iAyvFJ4shU3FNA4LhgO.pdf", lpSrch=".wctc") returned 0x0 [0057.097] GetProcessHeap () returned 0x1130000 [0057.097] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.097] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\iAyvFJ4shU3FNA4LhgO.pdf.wctc") returned 103 [0057.097] CloseHandle (hObject=0x3c0) returned 1 [0057.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\iAyvFJ4shU3FNA4LhgO.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\iayvfj4shu3fna4lhgo.pdf"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\iAyvFJ4shU3FNA4LhgO.pdf.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\iayvfj4shu3fna4lhgo.pdf.wctc")) returned 1 [0057.097] GetProcessHeap () returned 0x1130000 [0057.097] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.097] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 320 [0057.097] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.097] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e92372, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e92372, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.098] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\read_me.txt") returned 86 [0057.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.098] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.098] GetProcessHeap () returned 0x1130000 [0057.098] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.098] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\uW7NNN.csv.wctc") returned 90 [0057.098] CloseHandle (hObject=0x3c0) returned 1 [0057.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\uW7NNN.csv" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\uw7nnn.csv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\uW7NNN.csv.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\uw7nnn.csv.wctc")) returned 1 [0057.098] GetProcessHeap () returned 0x1130000 [0057.098] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.098] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 321 [0057.098] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.098] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2faa0d60, ftCreationTime.dwHighDateTime=0x1d4cd92, ftLastAccessTime.dwLowDateTime=0x7d4a1e30, ftLastAccessTime.dwHighDateTime=0x1d4d5c5, ftLastWriteTime.dwLowDateTime=0x7d4a1e30, ftLastWriteTime.dwHighDateTime=0x1d4d5c5, nFileSizeHigh=0x0, nFileSizeLow=0x16fc0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="vOBIljbtGrF6i.pptx", cAlternateFileName="VOBILJ~1.PPT")) returned 1 [0057.098] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\vOBIljbtGrF6i.pptx") returned 93 [0057.099] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\vOBIljbtGrF6i.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\vobiljbtgrf6i.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.099] StrStrW (lpFirst="vOBIljbtGrF6i.pptx", lpSrch=".wctc") returned 0x0 [0057.099] GetProcessHeap () returned 0x1130000 [0057.099] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.099] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\vOBIljbtGrF6i.pptx.wctc") returned 98 [0057.099] CloseHandle (hObject=0x3c0) returned 1 [0057.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\vOBIljbtGrF6i.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\vobiljbtgrf6i.pptx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\vOBIljbtGrF6i.pptx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\cen69gcez75ml9uaj\\vobiljbtgrf6i.pptx.wctc")) returned 1 [0057.099] GetProcessHeap () returned 0x1130000 [0057.099] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.099] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 322 [0057.099] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.099] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2faa0d60, ftCreationTime.dwHighDateTime=0x1d4cd92, ftLastAccessTime.dwLowDateTime=0x7d4a1e30, ftLastAccessTime.dwHighDateTime=0x1d4d5c5, ftLastWriteTime.dwLowDateTime=0x7d4a1e30, ftLastWriteTime.dwHighDateTime=0x1d4d5c5, nFileSizeHigh=0x0, nFileSizeLow=0x16fc0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="vobiljbtgrf6i.pptx", cAlternateFileName="VOBILJ~1.PPT")) returned 0 [0057.099] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0057.099] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\cEN69gCeZ75mL9uAJ\\read_me.txt") returned 86 [0057.100] GetProcessHeap () returned 0x1130000 [0057.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.100] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 128 [0057.100] GetProcessHeap () returned 0x1130000 [0057.100] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e80198 | out: hHeap=0x1130000) returned 1 [0057.100] GetProcessHeap () returned 0x1130000 [0057.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3e80198 [0057.100] wnsprintfW (in: pszDest=0x3e80198, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\*") returned 70 [0057.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf09030c0, ftCreationTime.dwHighDateTime=0x1d4cb0a, ftLastAccessTime.dwLowDateTime=0x35528640, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.100] wnsprintfW (in: pszDest=0x3e80198, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\.") returned 70 [0057.100] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf09030c0, ftCreationTime.dwHighDateTime=0x1d4cb0a, ftLastAccessTime.dwLowDateTime=0x35528640, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.100] wnsprintfW (in: pszDest=0x3e80198, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\..") returned 71 [0057.100] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e92372, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e92372, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e92372, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.100] wnsprintfW (in: pszDest=0x3e80198, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\read_me.txt") returned 80 [0057.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\u-voanfhfz-\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.100] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.100] GetProcessHeap () returned 0x1130000 [0057.100] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.100] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\tQCRo2O5a4vGA OTdhoB.docx.wctc") returned 99 [0057.100] CloseHandle (hObject=0x3c0) returned 1 [0057.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\tQCRo2O5a4vGA OTdhoB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\u-voanfhfz-\\tqcro2o5a4vga otdhob.docx"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\tQCRo2O5a4vGA OTdhoB.docx.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\xp9dbmcz\\h9skpmkazwo9do2y-\\u-voanfhfz-\\tqcro2o5a4vga otdhob.docx.wctc")) returned 1 [0057.101] GetProcessHeap () returned 0x1130000 [0057.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.101] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 323 [0057.101] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.101] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a52830, ftCreationTime.dwHighDateTime=0x1d4ca66, ftLastAccessTime.dwLowDateTime=0x102b8040, ftLastAccessTime.dwHighDateTime=0x1d4d0a3, ftLastWriteTime.dwLowDateTime=0x102b8040, ftLastWriteTime.dwHighDateTime=0x1d4d0a3, nFileSizeHigh=0x0, nFileSizeLow=0x15d4f, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="tqcro2o5a4vga otdhob.docx", cAlternateFileName="TQCRO2~1.DOC")) returned 0 [0057.101] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.101] wnsprintfW (in: pszDest=0x3e80198, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\xP9DBmCz\\h9sKpMkAZwo9DO2y-\\u-VOaNfHFZ-\\read_me.txt") returned 80 [0057.101] GetProcessHeap () returned 0x1130000 [0057.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e80198 | out: hHeap=0x1130000) returned 1 [0057.101] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 129 [0057.101] GetProcessHeap () returned 0x1130000 [0057.101] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e901a0 | out: hHeap=0x1130000) returned 1 [0057.103] GetProcessHeap () returned 0x1130000 [0057.103] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.103] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Downloads\\*") returned 31 [0057.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0057.104] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Downloads\\.") returned 31 [0057.104] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.104] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Downloads\\..") returned 32 [0057.104] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.104] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned 41 [0057.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.104] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.104] GetProcessHeap () returned 0x1130000 [0057.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.104] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 130 [0057.104] GetProcessHeap () returned 0x1130000 [0057.104] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d80118 | out: hHeap=0x1130000) returned 1 [0057.105] GetProcessHeap () returned 0x1130000 [0057.105] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.105] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\*") returned 31 [0057.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0057.105] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\.") returned 31 [0057.105] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.105] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\..") returned 32 [0057.105] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0057.105] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned 38 [0057.105] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.116] StrStrW (lpFirst="Bing.url", lpSrch=".wctc") returned 0x0 [0057.116] GetProcessHeap () returned 0x1130000 [0057.116] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.116] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Bing.url.wctc") returned 43 [0057.116] CloseHandle (hObject=0x3c0) returned 1 [0057.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\Bing.url.wctc" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.wctc")) returned 1 [0057.119] GetProcessHeap () returned 0x1130000 [0057.119] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.119] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 324 [0057.119] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.119] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.119] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned 41 [0057.119] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.120] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.120] GetProcessHeap () returned 0x1130000 [0057.120] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.120] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 132 [0057.120] GetProcessHeap () returned 0x1130000 [0057.120] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e40178 | out: hHeap=0x1130000) returned 1 [0057.121] GetProcessHeap () returned 0x1130000 [0057.121] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.121] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\*") returned 27 [0057.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.121] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\.") returned 27 [0057.121] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.121] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\..") returned 28 [0057.121] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.121] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\desktop.ini") returned 37 [0057.121] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.121] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.122] GetProcessHeap () returned 0x1130000 [0057.122] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.122] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\Desktop.lnk.wctc") returned 42 [0057.122] CloseHandle (hObject=0x3c0) returned 1 [0057.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\Desktop.lnk.wctc" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.wctc")) returned 1 [0057.123] GetProcessHeap () returned 0x1130000 [0057.123] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.123] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 325 [0057.123] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.123] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0057.123] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned 39 [0057.123] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.123] StrStrW (lpFirst="Downloads.lnk", lpSrch=".wctc") returned 0x0 [0057.123] GetProcessHeap () returned 0x1130000 [0057.123] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.123] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\Downloads.lnk.wctc") returned 44 [0057.123] CloseHandle (hObject=0x3c0) returned 1 [0057.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\Downloads.lnk.wctc" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.wctc")) returned 1 [0057.124] GetProcessHeap () returned 0x1130000 [0057.124] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.124] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 326 [0057.124] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.124] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0057.124] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned 38 [0057.124] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.125] StrStrW (lpFirst="OneDrive.lnk", lpSrch=".wctc") returned 0x0 [0057.125] GetProcessHeap () returned 0x1130000 [0057.125] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.125] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.wctc") returned 43 [0057.125] CloseHandle (hObject=0x3c0) returned 1 [0057.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.wctc" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.wctc")) returned 1 [0057.127] GetProcessHeap () returned 0x1130000 [0057.127] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.127] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 327 [0057.127] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.127] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb667b, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fb667b, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.127] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Links\\read_me.txt") returned 37 [0057.127] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Links\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\links\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.127] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.127] GetProcessHeap () returned 0x1130000 [0057.127] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.127] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 133 [0057.127] GetProcessHeap () returned 0x1130000 [0057.127] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e70190 | out: hHeap=0x1130000) returned 1 [0057.129] GetProcessHeap () returned 0x1130000 [0057.129] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.129] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Local Settings\\*") returned 36 [0057.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb667b, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fb667b, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fb667b, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0057.129] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Local Settings\\read_me.txt") returned 46 [0057.129] GetProcessHeap () returned 0x1130000 [0057.129] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.131] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 134 [0057.131] GetProcessHeap () returned 0x1130000 [0057.131] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3eb01b0 | out: hHeap=0x1130000) returned 1 [0057.131] GetProcessHeap () returned 0x1130000 [0057.131] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.132] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\*") returned 27 [0057.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.132] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\.") returned 27 [0057.132] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.132] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\..") returned 28 [0057.132] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ae59f0, ftCreationTime.dwHighDateTime=0x1d4c782, ftLastAccessTime.dwLowDateTime=0x4f1f69c0, ftLastAccessTime.dwHighDateTime=0x1d4d4a8, ftLastWriteTime.dwLowDateTime=0x4f1f69c0, ftLastWriteTime.dwHighDateTime=0x1d4d4a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="4FTiJ2yRkuQl_WF f1B", cAlternateFileName="4FTIJ2~1")) returned 1 [0057.132] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B") returned 45 [0057.132] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7949f0, ftCreationTime.dwHighDateTime=0x1d4d204, ftLastAccessTime.dwLowDateTime=0x6b921600, ftLastAccessTime.dwHighDateTime=0x1d4c5dc, ftLastWriteTime.dwLowDateTime=0x6b921600, ftLastWriteTime.dwHighDateTime=0x1d4c5dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="5j6qS2RSr", cAlternateFileName="5J6QS2~1")) returned 1 [0057.132] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr") returned 35 [0057.132] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.132] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\desktop.ini") returned 37 [0057.132] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.133] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.133] GetProcessHeap () returned 0x1130000 [0057.133] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.134] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\JoYBQ.mp3.wctc") returned 40 [0057.134] CloseHandle (hObject=0x3c0) returned 1 [0057.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\JoYBQ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\joybq.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\JoYBQ.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\joybq.mp3.wctc")) returned 1 [0057.134] GetProcessHeap () returned 0x1130000 [0057.134] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.134] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 328 [0057.134] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.134] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d38be2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2d38be2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d38be2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.134] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\read_me.txt") returned 37 [0057.134] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.134] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.135] GetProcessHeap () returned 0x1130000 [0057.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.135] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\UJu6GAm_KLvf4iqy.mp3.wctc") returned 51 [0057.135] CloseHandle (hObject=0x3c0) returned 1 [0057.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\UJu6GAm_KLvf4iqy.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uju6gam_klvf4iqy.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\UJu6GAm_KLvf4iqy.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\uju6gam_klvf4iqy.mp3.wctc")) returned 1 [0057.135] GetProcessHeap () returned 0x1130000 [0057.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.135] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 329 [0057.135] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.135] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6169a0, ftCreationTime.dwHighDateTime=0x1d4c90a, ftLastAccessTime.dwLowDateTime=0x7efb2160, ftLastAccessTime.dwHighDateTime=0x1d4cc34, ftLastWriteTime.dwLowDateTime=0x7efb2160, ftLastWriteTime.dwHighDateTime=0x1d4cc34, nFileSizeHigh=0x0, nFileSizeLow=0x14253, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="uju6gam_klvf4iqy.mp3", cAlternateFileName="UJU6GA~1.MP3")) returned 0 [0057.135] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.135] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\read_me.txt") returned 37 [0057.135] GetProcessHeap () returned 0x1130000 [0057.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.135] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 135 [0057.135] GetProcessHeap () returned 0x1130000 [0057.135] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ec01b8 | out: hHeap=0x1130000) returned 1 [0057.135] GetProcessHeap () returned 0x1130000 [0057.135] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.135] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\*") returned 47 [0057.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ae59f0, ftCreationTime.dwHighDateTime=0x1d4c782, ftLastAccessTime.dwLowDateTime=0x4f1f69c0, ftLastAccessTime.dwHighDateTime=0x1d4d4a8, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.136] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\.") returned 47 [0057.136] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ae59f0, ftCreationTime.dwHighDateTime=0x1d4c782, ftLastAccessTime.dwLowDateTime=0x4f1f69c0, ftLastAccessTime.dwHighDateTime=0x1d4d4a8, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.136] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\..") returned 48 [0057.136] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50588790, ftCreationTime.dwHighDateTime=0x1d4d50c, ftLastAccessTime.dwLowDateTime=0xf17e1ea0, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0xf17e1ea0, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="e4orhIul1aBHqg8KZabc", cAlternateFileName="E4ORHI~1")) returned 1 [0057.136] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc") returned 66 [0057.136] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8974f490, ftCreationTime.dwHighDateTime=0x1d4d58f, ftLastAccessTime.dwLowDateTime=0xa51ad5f0, ftLastAccessTime.dwHighDateTime=0x1d4d5a0, ftLastWriteTime.dwLowDateTime=0xa51ad5f0, ftLastWriteTime.dwHighDateTime=0x1d4d5a0, nFileSizeHigh=0x0, nFileSizeLow=0x2be3, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="EEzU-1-uD5j8kPYuYTD.m4a", cAlternateFileName="EEZU-1~1.M4A")) returned 1 [0057.136] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\EEzU-1-uD5j8kPYuYTD.m4a") returned 69 [0057.136] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\EEzU-1-uD5j8kPYuYTD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\eezu-1-ud5j8kpyuytd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.136] StrStrW (lpFirst="EEzU-1-uD5j8kPYuYTD.m4a", lpSrch=".wctc") returned 0x0 [0057.136] GetProcessHeap () returned 0x1130000 [0057.136] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.136] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\EEzU-1-uD5j8kPYuYTD.m4a.wctc") returned 74 [0057.136] CloseHandle (hObject=0x3c0) returned 1 [0057.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\EEzU-1-uD5j8kPYuYTD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\eezu-1-ud5j8kpyuytd.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\EEzU-1-uD5j8kPYuYTD.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\eezu-1-ud5j8kpyuytd.m4a.wctc")) returned 1 [0057.137] GetProcessHeap () returned 0x1130000 [0057.137] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.137] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 330 [0057.137] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.137] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68322690, ftCreationTime.dwHighDateTime=0x1d4ca18, ftLastAccessTime.dwLowDateTime=0x5d1227d0, ftLastAccessTime.dwHighDateTime=0x1d4ce30, ftLastWriteTime.dwLowDateTime=0x5d1227d0, ftLastWriteTime.dwHighDateTime=0x1d4ce30, nFileSizeHigh=0x0, nFileSizeLow=0x6fba, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="JsnQunzdxY W28UR4w.wav", cAlternateFileName="JSNQUN~1.WAV")) returned 1 [0057.137] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\JsnQunzdxY W28UR4w.wav") returned 68 [0057.137] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\JsnQunzdxY W28UR4w.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\jsnqunzdxy w28ur4w.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.137] StrStrW (lpFirst="JsnQunzdxY W28UR4w.wav", lpSrch=".wctc") returned 0x0 [0057.137] GetProcessHeap () returned 0x1130000 [0057.137] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.137] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\JsnQunzdxY W28UR4w.wav.wctc") returned 73 [0057.137] CloseHandle (hObject=0x3c0) returned 1 [0057.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\JsnQunzdxY W28UR4w.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\jsnqunzdxy w28ur4w.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\JsnQunzdxY W28UR4w.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\jsnqunzdxy w28ur4w.wav.wctc")) returned 1 [0057.138] GetProcessHeap () returned 0x1130000 [0057.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.138] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 331 [0057.138] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.138] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30c1ee4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30c1ee4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.138] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\read_me.txt") returned 57 [0057.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.138] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.138] GetProcessHeap () returned 0x1130000 [0057.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.138] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 136 [0057.138] GetProcessHeap () returned 0x1130000 [0057.138] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.138] GetProcessHeap () returned 0x1130000 [0057.138] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.138] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\*") returned 68 [0057.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50588790, ftCreationTime.dwHighDateTime=0x1d4d50c, ftLastAccessTime.dwLowDateTime=0xf17e1ea0, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0057.138] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\.") returned 68 [0057.138] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50588790, ftCreationTime.dwHighDateTime=0x1d4d50c, ftLastAccessTime.dwLowDateTime=0xf17e1ea0, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.138] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\..") returned 69 [0057.138] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704971b0, ftCreationTime.dwHighDateTime=0x1d4d3c0, ftLastAccessTime.dwLowDateTime=0x2e916410, ftLastAccessTime.dwHighDateTime=0x1d4d52a, ftLastWriteTime.dwLowDateTime=0x2e916410, ftLastWriteTime.dwHighDateTime=0x1d4d52a, nFileSizeHigh=0x0, nFileSizeLow=0x56e3, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="EkTlFGzYn6rqQXCKyS R.wav", cAlternateFileName="EKTLFG~1.WAV")) returned 1 [0057.139] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\EkTlFGzYn6rqQXCKyS R.wav") returned 91 [0057.139] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\EkTlFGzYn6rqQXCKyS R.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\ektlfgzyn6rqqxckys r.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.139] StrStrW (lpFirst="EkTlFGzYn6rqQXCKyS R.wav", lpSrch=".wctc") returned 0x0 [0057.139] GetProcessHeap () returned 0x1130000 [0057.139] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.139] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\EkTlFGzYn6rqQXCKyS R.wav.wctc") returned 96 [0057.139] CloseHandle (hObject=0x3c0) returned 1 [0057.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\EkTlFGzYn6rqQXCKyS R.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\ektlfgzyn6rqqxckys r.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\EkTlFGzYn6rqQXCKyS R.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\ektlfgzyn6rqqxckys r.wav.wctc")) returned 1 [0057.139] GetProcessHeap () returned 0x1130000 [0057.139] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.139] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 332 [0057.139] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.139] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac12c90, ftCreationTime.dwHighDateTime=0x1d4d26e, ftLastAccessTime.dwLowDateTime=0x73be8150, ftLastAccessTime.dwHighDateTime=0x1d4cf38, ftLastWriteTime.dwLowDateTime=0x73be8150, ftLastWriteTime.dwHighDateTime=0x1d4cf38, nFileSizeHigh=0x0, nFileSizeLow=0x633f, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="HJ 3xtiN-E8fQHRnr-.wav", cAlternateFileName="HJ3XTI~1.WAV")) returned 1 [0057.139] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\HJ 3xtiN-E8fQHRnr-.wav") returned 89 [0057.139] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\HJ 3xtiN-E8fQHRnr-.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\hj 3xtin-e8fqhrnr-.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.140] StrStrW (lpFirst="HJ 3xtiN-E8fQHRnr-.wav", lpSrch=".wctc") returned 0x0 [0057.140] GetProcessHeap () returned 0x1130000 [0057.140] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.140] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\HJ 3xtiN-E8fQHRnr-.wav.wctc") returned 94 [0057.140] CloseHandle (hObject=0x3c0) returned 1 [0057.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\HJ 3xtiN-E8fQHRnr-.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\hj 3xtin-e8fqhrnr-.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\HJ 3xtiN-E8fQHRnr-.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\hj 3xtin-e8fqhrnr-.wav.wctc")) returned 1 [0057.140] GetProcessHeap () returned 0x1130000 [0057.140] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.140] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 333 [0057.140] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.140] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30c1ee4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30c1ee4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.140] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\read_me.txt") returned 78 [0057.140] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.141] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.141] GetProcessHeap () returned 0x1130000 [0057.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.141] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 137 [0057.141] GetProcessHeap () returned 0x1130000 [0057.141] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.143] GetProcessHeap () returned 0x1130000 [0057.143] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0057.144] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\*") returned 83 [0057.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60e739b0, ftCreationTime.dwHighDateTime=0x1d4d167, ftLastAccessTime.dwLowDateTime=0xf30028d3, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.144] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\.") returned 83 [0057.144] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60e739b0, ftCreationTime.dwHighDateTime=0x1d4d167, ftLastAccessTime.dwLowDateTime=0xf30028d3, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.144] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\..") returned 84 [0057.144] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe9b2380, ftCreationTime.dwHighDateTime=0x1d4cc82, ftLastAccessTime.dwLowDateTime=0x1218c1c0, ftLastAccessTime.dwHighDateTime=0x1d4c715, ftLastWriteTime.dwLowDateTime=0x1218c1c0, ftLastWriteTime.dwHighDateTime=0x1d4c715, nFileSizeHigh=0x0, nFileSizeLow=0xd7a3, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="9jrB8s6i7To7ilvSVow.wav", cAlternateFileName="9JRB8S~1.WAV")) returned 1 [0057.144] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\9jrB8s6i7To7ilvSVow.wav") returned 105 [0057.144] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\9jrB8s6i7To7ilvSVow.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\9jrb8s6i7to7ilvsvow.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.144] StrStrW (lpFirst="9jrB8s6i7To7ilvSVow.wav", lpSrch=".wctc") returned 0x0 [0057.144] GetProcessHeap () returned 0x1130000 [0057.144] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.145] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\9jrB8s6i7To7ilvSVow.wav.wctc") returned 110 [0057.145] CloseHandle (hObject=0x3c0) returned 1 [0057.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\9jrB8s6i7To7ilvSVow.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\9jrb8s6i7to7ilvsvow.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\9jrB8s6i7To7ilvSVow.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\9jrb8s6i7to7ilvsvow.wav.wctc")) returned 1 [0057.145] GetProcessHeap () returned 0x1130000 [0057.145] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.145] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 334 [0057.146] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.146] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936dea80, ftCreationTime.dwHighDateTime=0x1d4d25e, ftLastAccessTime.dwLowDateTime=0xaa712a30, ftLastAccessTime.dwHighDateTime=0x1d4c87c, ftLastWriteTime.dwLowDateTime=0xaa712a30, ftLastWriteTime.dwHighDateTime=0x1d4c87c, nFileSizeHigh=0x0, nFileSizeLow=0xb877, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="c1NaQjgjflbLvi.wav", cAlternateFileName="C1NAQJ~1.WAV")) returned 1 [0057.146] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\c1NaQjgjflbLvi.wav") returned 100 [0057.146] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\c1NaQjgjflbLvi.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\c1naqjgjflblvi.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.146] StrStrW (lpFirst="c1NaQjgjflbLvi.wav", lpSrch=".wctc") returned 0x0 [0057.146] GetProcessHeap () returned 0x1130000 [0057.146] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.146] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\c1NaQjgjflbLvi.wav.wctc") returned 105 [0057.146] CloseHandle (hObject=0x3c0) returned 1 [0057.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\c1NaQjgjflbLvi.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\c1naqjgjflblvi.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\c1NaQjgjflbLvi.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\c1naqjgjflblvi.wav.wctc")) returned 1 [0057.146] GetProcessHeap () returned 0x1130000 [0057.146] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.146] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 335 [0057.146] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.146] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60f13370, ftCreationTime.dwHighDateTime=0x1d4cd43, ftLastAccessTime.dwLowDateTime=0xf2fdc72e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fdc72e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="E8Z5TJoPLK1iy6", cAlternateFileName="E8Z5TJ~1")) returned 1 [0057.147] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6") returned 96 [0057.147] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf4767c0, ftCreationTime.dwHighDateTime=0x1d4c676, ftLastAccessTime.dwLowDateTime=0xb35c8b0, ftLastAccessTime.dwHighDateTime=0x1d4d239, ftLastWriteTime.dwLowDateTime=0xb35c8b0, ftLastWriteTime.dwHighDateTime=0x1d4d239, nFileSizeHigh=0x0, nFileSizeLow=0x1433f, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="eZlD1vAjb.m4a", cAlternateFileName="EZLD1V~1.M4A")) returned 1 [0057.147] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\eZlD1vAjb.m4a") returned 95 [0057.147] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\eZlD1vAjb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\ezld1vajb.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.147] StrStrW (lpFirst="eZlD1vAjb.m4a", lpSrch=".wctc") returned 0x0 [0057.147] GetProcessHeap () returned 0x1130000 [0057.147] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.147] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\eZlD1vAjb.m4a.wctc") returned 100 [0057.147] CloseHandle (hObject=0x3c0) returned 1 [0057.147] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\eZlD1vAjb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\ezld1vajb.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\eZlD1vAjb.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\ezld1vajb.m4a.wctc")) returned 1 [0057.147] GetProcessHeap () returned 0x1130000 [0057.147] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.147] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 336 [0057.147] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.147] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe805050, ftCreationTime.dwHighDateTime=0x1d4d1ab, ftLastAccessTime.dwLowDateTime=0xa3ddd630, ftLastAccessTime.dwHighDateTime=0x1d4c978, ftLastWriteTime.dwLowDateTime=0xa3ddd630, ftLastWriteTime.dwHighDateTime=0x1d4c978, nFileSizeHigh=0x0, nFileSizeLow=0xec44, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="h84ZqhXk.mp3", cAlternateFileName="")) returned 1 [0057.147] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\h84ZqhXk.mp3") returned 94 [0057.147] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\h84ZqhXk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\h84zqhxk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.148] StrStrW (lpFirst="h84ZqhXk.mp3", lpSrch=".wctc") returned 0x0 [0057.148] GetProcessHeap () returned 0x1130000 [0057.148] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.148] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\h84ZqhXk.mp3.wctc") returned 99 [0057.148] CloseHandle (hObject=0x3c0) returned 1 [0057.148] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\h84ZqhXk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\h84zqhxk.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\h84ZqhXk.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\h84zqhxk.mp3.wctc")) returned 1 [0057.148] GetProcessHeap () returned 0x1130000 [0057.148] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.148] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 337 [0057.148] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.148] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e1a43a0, ftCreationTime.dwHighDateTime=0x1d4d040, ftLastAccessTime.dwLowDateTime=0xc8b05a60, ftLastAccessTime.dwHighDateTime=0x1d4c6e8, ftLastWriteTime.dwLowDateTime=0xc8b05a60, ftLastWriteTime.dwHighDateTime=0x1d4c6e8, nFileSizeHigh=0x0, nFileSizeLow=0xd548, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="L0eQwqm2Z9rHA.wav", cAlternateFileName="L0EQWQ~1.WAV")) returned 1 [0057.148] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\L0eQwqm2Z9rHA.wav") returned 99 [0057.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\L0eQwqm2Z9rHA.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\l0eqwqm2z9rha.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.148] StrStrW (lpFirst="L0eQwqm2Z9rHA.wav", lpSrch=".wctc") returned 0x0 [0057.149] GetProcessHeap () returned 0x1130000 [0057.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.149] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\L0eQwqm2Z9rHA.wav.wctc") returned 104 [0057.149] CloseHandle (hObject=0x3c0) returned 1 [0057.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\L0eQwqm2Z9rHA.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\l0eqwqm2z9rha.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\L0eQwqm2Z9rHA.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\l0eqwqm2z9rha.wav.wctc")) returned 1 [0057.149] GetProcessHeap () returned 0x1130000 [0057.149] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.149] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 338 [0057.149] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.149] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b9daea0, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x4358d210, ftLastAccessTime.dwHighDateTime=0x1d4d22e, ftLastWriteTime.dwLowDateTime=0x4358d210, ftLastWriteTime.dwHighDateTime=0x1d4d22e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="n_ilhG4PKt 7Fb", cAlternateFileName="N_ILHG~1")) returned 1 [0057.149] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb") returned 96 [0057.149] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30028d3, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30028d3, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.149] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\read_me.txt") returned 93 [0057.149] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.149] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.149] GetProcessHeap () returned 0x1130000 [0057.149] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.150] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\uJF6r4sdo.wav.wctc") returned 100 [0057.150] CloseHandle (hObject=0x3c0) returned 1 [0057.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\uJF6r4sdo.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\ujf6r4sdo.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\uJF6r4sdo.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\ujf6r4sdo.wav.wctc")) returned 1 [0057.150] GetProcessHeap () returned 0x1130000 [0057.150] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.150] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 339 [0057.150] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.150] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf72f160, ftCreationTime.dwHighDateTime=0x1d4c881, ftLastAccessTime.dwLowDateTime=0x11be1dd0, ftLastAccessTime.dwHighDateTime=0x1d4d5eb, ftLastWriteTime.dwLowDateTime=0x11be1dd0, ftLastWriteTime.dwHighDateTime=0x1d4d5eb, nFileSizeHigh=0x0, nFileSizeLow=0x11e47, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="vL7hYIjHNSJpUvIFNtBP.m4a", cAlternateFileName="VL7HYI~1.M4A")) returned 1 [0057.150] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\vL7hYIjHNSJpUvIFNtBP.m4a") returned 106 [0057.150] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\vL7hYIjHNSJpUvIFNtBP.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\vl7hyijhnsjpuvifntbp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.150] StrStrW (lpFirst="vL7hYIjHNSJpUvIFNtBP.m4a", lpSrch=".wctc") returned 0x0 [0057.150] GetProcessHeap () returned 0x1130000 [0057.150] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.151] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\vL7hYIjHNSJpUvIFNtBP.m4a.wctc") returned 111 [0057.151] CloseHandle (hObject=0x3c0) returned 1 [0057.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\vL7hYIjHNSJpUvIFNtBP.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\vl7hyijhnsjpuvifntbp.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\vL7hYIjHNSJpUvIFNtBP.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\vl7hyijhnsjpuvifntbp.m4a.wctc")) returned 1 [0057.151] GetProcessHeap () returned 0x1130000 [0057.151] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.151] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 340 [0057.151] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.151] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6548c260, ftCreationTime.dwHighDateTime=0x1d4d254, ftLastAccessTime.dwLowDateTime=0x8a063790, ftLastAccessTime.dwHighDateTime=0x1d4d45c, ftLastWriteTime.dwLowDateTime=0x8a063790, ftLastWriteTime.dwHighDateTime=0x1d4d45c, nFileSizeHigh=0x0, nFileSizeLow=0xbb10, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="z9VC20lul.m4a", cAlternateFileName="Z9VC20~1.M4A")) returned 1 [0057.151] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\z9VC20lul.m4a") returned 95 [0057.151] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\z9VC20lul.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\z9vc20lul.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.151] StrStrW (lpFirst="z9VC20lul.m4a", lpSrch=".wctc") returned 0x0 [0057.151] GetProcessHeap () returned 0x1130000 [0057.151] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.151] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\z9VC20lul.m4a.wctc") returned 100 [0057.151] CloseHandle (hObject=0x3c0) returned 1 [0057.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\z9VC20lul.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\z9vc20lul.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\z9VC20lul.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\z9vc20lul.m4a.wctc")) returned 1 [0057.152] GetProcessHeap () returned 0x1130000 [0057.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.152] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 341 [0057.152] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.152] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6548c260, ftCreationTime.dwHighDateTime=0x1d4d254, ftLastAccessTime.dwLowDateTime=0x8a063790, ftLastAccessTime.dwHighDateTime=0x1d4d45c, ftLastWriteTime.dwLowDateTime=0x8a063790, ftLastWriteTime.dwHighDateTime=0x1d4d45c, nFileSizeHigh=0x0, nFileSizeLow=0xbb10, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="z9vc20lul.m4a", cAlternateFileName="Z9VC20~1.M4A")) returned 0 [0057.152] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.152] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\read_me.txt") returned 93 [0057.152] GetProcessHeap () returned 0x1130000 [0057.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.152] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 138 [0057.152] GetProcessHeap () returned 0x1130000 [0057.152] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.300] GetProcessHeap () returned 0x1130000 [0057.300] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f401f8 [0057.301] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\*") returned 113 [0057.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5cb966d0, ftCreationTime.dwHighDateTime=0x1d4c698, ftLastAccessTime.dwLowDateTime=0x4da98380, ftLastAccessTime.dwHighDateTime=0x1d4c82f, ftLastWriteTime.dwLowDateTime=0xf2fdc72e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.301] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\.") returned 113 [0057.301] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5cb966d0, ftCreationTime.dwHighDateTime=0x1d4c698, ftLastAccessTime.dwLowDateTime=0x4da98380, ftLastAccessTime.dwHighDateTime=0x1d4c82f, ftLastWriteTime.dwLowDateTime=0xf2fdc72e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.301] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\..") returned 114 [0057.301] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf206900, ftCreationTime.dwHighDateTime=0x1d4cfcb, ftLastAccessTime.dwLowDateTime=0x550aeda0, ftLastAccessTime.dwHighDateTime=0x1d4ce1d, ftLastWriteTime.dwLowDateTime=0x550aeda0, ftLastWriteTime.dwHighDateTime=0x1d4ce1d, nFileSizeHigh=0x0, nFileSizeLow=0x7120, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="7TFWEVyJ-dCmRVSA6.mp3", cAlternateFileName="7TFWEV~1.MP3")) returned 1 [0057.301] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\7TFWEVyJ-dCmRVSA6.mp3") returned 133 [0057.301] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\7TFWEVyJ-dCmRVSA6.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\7tfwevyj-dcmrvsa6.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.301] StrStrW (lpFirst="7TFWEVyJ-dCmRVSA6.mp3", lpSrch=".wctc") returned 0x0 [0057.301] GetProcessHeap () returned 0x1130000 [0057.301] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0057.302] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\7TFWEVyJ-dCmRVSA6.mp3.wctc") returned 138 [0057.302] CloseHandle (hObject=0x3c0) returned 1 [0057.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\7TFWEVyJ-dCmRVSA6.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\7tfwevyj-dcmrvsa6.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\7TFWEVyJ-dCmRVSA6.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\7tfwevyj-dcmrvsa6.mp3.wctc")) returned 1 [0057.303] GetProcessHeap () returned 0x1130000 [0057.303] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.303] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 347 [0057.303] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.303] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x275cccd0, ftCreationTime.dwHighDateTime=0x1d4c98a, ftLastAccessTime.dwLowDateTime=0xae823460, ftLastAccessTime.dwHighDateTime=0x1d4d39a, ftLastWriteTime.dwLowDateTime=0xae823460, ftLastWriteTime.dwHighDateTime=0x1d4d39a, nFileSizeHigh=0x0, nFileSizeLow=0xe22a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="9IIfC.m4a", cAlternateFileName="")) returned 1 [0057.303] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\9IIfC.m4a") returned 121 [0057.303] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\9IIfC.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\9iifc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.303] StrStrW (lpFirst="9IIfC.m4a", lpSrch=".wctc") returned 0x0 [0057.303] GetProcessHeap () returned 0x1130000 [0057.303] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0057.303] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\9IIfC.m4a.wctc") returned 126 [0057.303] CloseHandle (hObject=0x3c0) returned 1 [0057.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\9IIfC.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\9iifc.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\9IIfC.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\9iifc.m4a.wctc")) returned 1 [0057.304] GetProcessHeap () returned 0x1130000 [0057.304] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.304] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 348 [0057.304] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.304] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae27c7e0, ftCreationTime.dwHighDateTime=0x1d4d364, ftLastAccessTime.dwLowDateTime=0x6ba923e0, ftLastAccessTime.dwHighDateTime=0x1d4cc94, ftLastWriteTime.dwLowDateTime=0x6ba923e0, ftLastWriteTime.dwHighDateTime=0x1d4cc94, nFileSizeHigh=0x0, nFileSizeLow=0xe37e, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="LwNl8-rW.wav", cAlternateFileName="")) returned 1 [0057.304] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\LwNl8-rW.wav") returned 124 [0057.304] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\LwNl8-rW.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\lwnl8-rw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.304] StrStrW (lpFirst="LwNl8-rW.wav", lpSrch=".wctc") returned 0x0 [0057.304] GetProcessHeap () returned 0x1130000 [0057.304] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0057.304] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\LwNl8-rW.wav.wctc") returned 129 [0057.304] CloseHandle (hObject=0x3c0) returned 1 [0057.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\LwNl8-rW.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\lwnl8-rw.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\LwNl8-rW.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\lwnl8-rw.wav.wctc")) returned 1 [0057.305] GetProcessHeap () returned 0x1130000 [0057.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.305] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 349 [0057.305] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.305] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf34cd2e0, ftCreationTime.dwHighDateTime=0x1d4c7a0, ftLastAccessTime.dwLowDateTime=0xb4dea180, ftLastAccessTime.dwHighDateTime=0x1d4caa9, ftLastWriteTime.dwLowDateTime=0xb4dea180, ftLastWriteTime.dwHighDateTime=0x1d4caa9, nFileSizeHigh=0x0, nFileSizeLow=0x6dbc, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="mkMHHOm.wav", cAlternateFileName="")) returned 1 [0057.305] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mkMHHOm.wav") returned 123 [0057.305] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mkMHHOm.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\mkmhhom.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.305] StrStrW (lpFirst="mkMHHOm.wav", lpSrch=".wctc") returned 0x0 [0057.305] GetProcessHeap () returned 0x1130000 [0057.305] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0057.305] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mkMHHOm.wav.wctc") returned 128 [0057.305] CloseHandle (hObject=0x3c0) returned 1 [0057.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mkMHHOm.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\mkmhhom.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mkMHHOm.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\mkmhhom.wav.wctc")) returned 1 [0057.305] GetProcessHeap () returned 0x1130000 [0057.305] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.305] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 350 [0057.305] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.306] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ed4d80, ftCreationTime.dwHighDateTime=0x1d4cadf, ftLastAccessTime.dwLowDateTime=0x145dc000, ftLastAccessTime.dwHighDateTime=0x1d4d0ea, ftLastWriteTime.dwLowDateTime=0x145dc000, ftLastWriteTime.dwHighDateTime=0x1d4d0ea, nFileSizeHigh=0x0, nFileSizeLow=0x10708, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="mo5GlVx0TiW2qS1P.wav", cAlternateFileName="MO5GLV~1.WAV")) returned 1 [0057.306] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mo5GlVx0TiW2qS1P.wav") returned 132 [0057.306] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mo5GlVx0TiW2qS1P.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\mo5glvx0tiw2qs1p.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.306] StrStrW (lpFirst="mo5GlVx0TiW2qS1P.wav", lpSrch=".wctc") returned 0x0 [0057.306] GetProcessHeap () returned 0x1130000 [0057.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0057.306] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mo5GlVx0TiW2qS1P.wav.wctc") returned 137 [0057.306] CloseHandle (hObject=0x3c0) returned 1 [0057.306] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mo5GlVx0TiW2qS1P.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\mo5glvx0tiw2qs1p.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\mo5GlVx0TiW2qS1P.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\mo5glvx0tiw2qs1p.wav.wctc")) returned 1 [0057.306] GetProcessHeap () returned 0x1130000 [0057.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.306] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 351 [0057.307] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.307] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9064570, ftCreationTime.dwHighDateTime=0x1d4cae7, ftLastAccessTime.dwLowDateTime=0xcdc6cdb0, ftLastAccessTime.dwHighDateTime=0x1d4ce84, ftLastWriteTime.dwLowDateTime=0xcdc6cdb0, ftLastWriteTime.dwHighDateTime=0x1d4ce84, nFileSizeHigh=0x0, nFileSizeLow=0x18802, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="OYRQGOuqa72Cv.wav", cAlternateFileName="OYRQGO~1.WAV")) returned 1 [0057.307] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\OYRQGOuqa72Cv.wav") returned 129 [0057.307] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\OYRQGOuqa72Cv.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\oyrqgouqa72cv.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.307] StrStrW (lpFirst="OYRQGOuqa72Cv.wav", lpSrch=".wctc") returned 0x0 [0057.307] GetProcessHeap () returned 0x1130000 [0057.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0057.307] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\OYRQGOuqa72Cv.wav.wctc") returned 134 [0057.307] CloseHandle (hObject=0x3c0) returned 1 [0057.307] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\OYRQGOuqa72Cv.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\oyrqgouqa72cv.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\OYRQGOuqa72Cv.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\oyrqgouqa72cv.wav.wctc")) returned 1 [0057.307] GetProcessHeap () returned 0x1130000 [0057.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.307] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 352 [0057.307] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.307] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fdc72e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fdc72e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fdc72e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.307] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\read_me.txt") returned 123 [0057.308] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\akjockxu5patg9\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.308] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.308] GetProcessHeap () returned 0x1130000 [0057.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f401f8 | out: hHeap=0x1130000) returned 1 [0057.308] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 140 [0057.308] GetProcessHeap () returned 0x1130000 [0057.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f60208 | out: hHeap=0x1130000) returned 1 [0057.309] GetProcessHeap () returned 0x1130000 [0057.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f60208 [0057.310] wnsprintfW (in: pszDest=0x3f60208, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\*") returned 98 [0057.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b9daea0, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x4358d210, ftLastAccessTime.dwHighDateTime=0x1d4d22e, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0057.310] wnsprintfW (in: pszDest=0x3f60208, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\.") returned 98 [0057.310] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b9daea0, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x4358d210, ftLastAccessTime.dwHighDateTime=0x1d4d22e, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.310] wnsprintfW (in: pszDest=0x3f60208, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\..") returned 99 [0057.310] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ebdd0, ftCreationTime.dwHighDateTime=0x1d4d4f5, ftLastAccessTime.dwLowDateTime=0x4e364190, ftLastAccessTime.dwHighDateTime=0x1d4d0df, ftLastWriteTime.dwLowDateTime=0x4e364190, ftLastWriteTime.dwHighDateTime=0x1d4d0df, nFileSizeHigh=0x0, nFileSizeLow=0x16c3b, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="I8GjTz1sjSq5cA.wav", cAlternateFileName="I8GJTZ~1.WAV")) returned 1 [0057.310] wnsprintfW (in: pszDest=0x3f60208, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\I8GjTz1sjSq5cA.wav") returned 115 [0057.310] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\I8GjTz1sjSq5cA.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\i8gjtz1sjsq5ca.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.311] StrStrW (lpFirst="I8GjTz1sjSq5cA.wav", lpSrch=".wctc") returned 0x0 [0057.311] GetProcessHeap () returned 0x1130000 [0057.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f401f8 [0057.312] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\I8GjTz1sjSq5cA.wav.wctc") returned 120 [0057.312] CloseHandle (hObject=0x3c0) returned 1 [0057.312] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\I8GjTz1sjSq5cA.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\i8gjtz1sjsq5ca.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\I8GjTz1sjSq5cA.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\i8gjtz1sjsq5ca.wav.wctc")) returned 1 [0057.312] GetProcessHeap () returned 0x1130000 [0057.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f401f8 | out: hHeap=0x1130000) returned 1 [0057.312] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 353 [0057.312] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.312] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30028d3, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30028d3, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.312] wnsprintfW (in: pszDest=0x3f60208, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\read_me.txt") returned 108 [0057.312] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.313] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.313] GetProcessHeap () returned 0x1130000 [0057.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f401f8 [0057.313] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\v4tJqiYZlKXg8.wav.wctc") returned 119 [0057.313] CloseHandle (hObject=0x3c0) returned 1 [0057.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\v4tJqiYZlKXg8.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\v4tjqiyzlkxg8.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\v4tJqiYZlKXg8.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\v4tjqiyzlkxg8.wav.wctc")) returned 1 [0057.313] GetProcessHeap () returned 0x1130000 [0057.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f401f8 | out: hHeap=0x1130000) returned 1 [0057.313] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 354 [0057.313] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.313] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58c18f50, ftCreationTime.dwHighDateTime=0x1d4d186, ftLastAccessTime.dwLowDateTime=0x1ee3b840, ftLastAccessTime.dwHighDateTime=0x1d4c6a9, ftLastWriteTime.dwLowDateTime=0x1ee3b840, ftLastWriteTime.dwHighDateTime=0x1d4c6a9, nFileSizeHigh=0x0, nFileSizeLow=0xdd4c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="XO5dD.m4a", cAlternateFileName="")) returned 1 [0057.313] wnsprintfW (in: pszDest=0x3f60208, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\XO5dD.m4a") returned 106 [0057.313] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\XO5dD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\xo5dd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.314] StrStrW (lpFirst="XO5dD.m4a", lpSrch=".wctc") returned 0x0 [0057.314] GetProcessHeap () returned 0x1130000 [0057.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f401f8 [0057.314] wnsprintfW (in: pszDest=0x3f401f8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\XO5dD.m4a.wctc") returned 111 [0057.314] CloseHandle (hObject=0x3c0) returned 1 [0057.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\XO5dD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\xo5dd.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\XO5dD.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\n_ilhg4pkt 7fb\\xo5dd.m4a.wctc")) returned 1 [0057.314] GetProcessHeap () returned 0x1130000 [0057.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f401f8 | out: hHeap=0x1130000) returned 1 [0057.314] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 355 [0057.314] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.314] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58c18f50, ftCreationTime.dwHighDateTime=0x1d4d186, ftLastAccessTime.dwLowDateTime=0x1ee3b840, ftLastAccessTime.dwHighDateTime=0x1d4c6a9, ftLastWriteTime.dwLowDateTime=0x1ee3b840, ftLastWriteTime.dwHighDateTime=0x1d4c6a9, nFileSizeHigh=0x0, nFileSizeLow=0xdd4c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="xo5dd.m4a", cAlternateFileName="")) returned 0 [0057.314] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0057.314] wnsprintfW (in: pszDest=0x3f60208, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\n_ilhG4PKt 7Fb\\read_me.txt") returned 108 [0057.314] GetProcessHeap () returned 0x1130000 [0057.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f60208 | out: hHeap=0x1130000) returned 1 [0057.314] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 141 [0057.314] GetProcessHeap () returned 0x1130000 [0057.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f50200 | out: hHeap=0x1130000) returned 1 [0057.315] GetProcessHeap () returned 0x1130000 [0057.315] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0057.316] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\*") returned 87 [0057.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0c2560, ftCreationTime.dwHighDateTime=0x1d4cbf4, ftLastAccessTime.dwLowDateTime=0xcc948ac0, ftLastAccessTime.dwHighDateTime=0x1d4d25f, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0057.316] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\.") returned 87 [0057.316] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0c2560, ftCreationTime.dwHighDateTime=0x1d4cbf4, ftLastAccessTime.dwLowDateTime=0xcc948ac0, ftLastAccessTime.dwHighDateTime=0x1d4d25f, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.316] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\..") returned 88 [0057.316] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94a99a50, ftCreationTime.dwHighDateTime=0x1d4cc75, ftLastAccessTime.dwLowDateTime=0x2af29240, ftLastAccessTime.dwHighDateTime=0x1d4c8d0, ftLastWriteTime.dwLowDateTime=0x2af29240, ftLastWriteTime.dwHighDateTime=0x1d4c8d0, nFileSizeHigh=0x0, nFileSizeLow=0x7912, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="cV6-6iG.mp3", cAlternateFileName="")) returned 1 [0057.317] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\cV6-6iG.mp3") returned 97 [0057.317] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\cV6-6iG.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\uhrn6b3uotpcahw4qo\\cv6-6ig.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.317] StrStrW (lpFirst="cV6-6iG.mp3", lpSrch=".wctc") returned 0x0 [0057.317] GetProcessHeap () returned 0x1130000 [0057.317] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0057.318] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\cV6-6iG.mp3.wctc") returned 102 [0057.318] CloseHandle (hObject=0x3c0) returned 1 [0057.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\cV6-6iG.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\uhrn6b3uotpcahw4qo\\cv6-6ig.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\cV6-6iG.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\uhrn6b3uotpcahw4qo\\cv6-6ig.mp3.wctc")) returned 1 [0057.318] GetProcessHeap () returned 0x1130000 [0057.318] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.318] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 356 [0057.318] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.318] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30028d3, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30028d3, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.318] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\read_me.txt") returned 97 [0057.319] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\UHrn6B3UOTpcahw4qo\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\uhrn6b3uotpcahw4qo\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.319] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.319] GetProcessHeap () returned 0x1130000 [0057.319] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.319] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 142 [0057.319] GetProcessHeap () returned 0x1130000 [0057.319] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f301f0 | out: hHeap=0x1130000) returned 1 [0057.321] GetProcessHeap () returned 0x1130000 [0057.321] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0057.321] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\*") returned 55 [0057.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3f6d860, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x504a5750, ftLastAccessTime.dwHighDateTime=0x1d4cbb7, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.322] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\.") returned 55 [0057.322] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3f6d860, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x504a5750, ftLastAccessTime.dwHighDateTime=0x1d4cbb7, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.322] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\..") returned 56 [0057.322] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30c1ee4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30c1ee4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.322] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\read_me.txt") returned 65 [0057.322] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.322] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.322] GetProcessHeap () returned 0x1130000 [0057.322] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.323] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\rgSZnfmdzt8aDmWJ.wav.wctc") returned 79 [0057.323] CloseHandle (hObject=0x3c0) returned 1 [0057.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\rgSZnfmdzt8aDmWJ.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\rgsznfmdzt8admwj.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\rgSZnfmdzt8aDmWJ.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\rgsznfmdzt8admwj.wav.wctc")) returned 1 [0057.323] GetProcessHeap () returned 0x1130000 [0057.323] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.323] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 357 [0057.323] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.323] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc26a65b0, ftCreationTime.dwHighDateTime=0x1d4c779, ftLastAccessTime.dwLowDateTime=0x57869460, ftLastAccessTime.dwHighDateTime=0x1d4cc4e, ftLastWriteTime.dwLowDateTime=0x57869460, ftLastWriteTime.dwHighDateTime=0x1d4cc4e, nFileSizeHigh=0x0, nFileSizeLow=0x87b, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="SdiFbdGlxP lkwOMqM.m4a", cAlternateFileName="SDIFBD~1.M4A")) returned 1 [0057.323] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\SdiFbdGlxP lkwOMqM.m4a") returned 76 [0057.324] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\SdiFbdGlxP lkwOMqM.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\sdifbdglxp lkwomqm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.324] StrStrW (lpFirst="SdiFbdGlxP lkwOMqM.m4a", lpSrch=".wctc") returned 0x0 [0057.324] GetProcessHeap () returned 0x1130000 [0057.324] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.324] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\SdiFbdGlxP lkwOMqM.m4a.wctc") returned 81 [0057.324] CloseHandle (hObject=0x3c0) returned 1 [0057.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\SdiFbdGlxP lkwOMqM.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\sdifbdglxp lkwomqm.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\SdiFbdGlxP lkwOMqM.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\sdifbdglxp lkwomqm.m4a.wctc")) returned 1 [0057.324] GetProcessHeap () returned 0x1130000 [0057.324] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.324] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 358 [0057.324] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.324] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb18520, ftCreationTime.dwHighDateTime=0x1d4c600, ftLastAccessTime.dwLowDateTime=0xd1256a20, ftLastAccessTime.dwHighDateTime=0x1d4ca33, ftLastWriteTime.dwLowDateTime=0xd1256a20, ftLastWriteTime.dwHighDateTime=0x1d4ca33, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="sZPvHNJb7w_0LLb.m4a", cAlternateFileName="SZPVHN~1.M4A")) returned 1 [0057.324] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\sZPvHNJb7w_0LLb.m4a") returned 73 [0057.324] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\sZPvHNJb7w_0LLb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\szpvhnjb7w_0llb.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.325] StrStrW (lpFirst="sZPvHNJb7w_0LLb.m4a", lpSrch=".wctc") returned 0x0 [0057.325] GetProcessHeap () returned 0x1130000 [0057.325] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.325] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\sZPvHNJb7w_0LLb.m4a.wctc") returned 78 [0057.325] CloseHandle (hObject=0x3c0) returned 1 [0057.325] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\sZPvHNJb7w_0LLb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\szpvhnjb7w_0llb.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\sZPvHNJb7w_0LLb.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\szpvhnjb7w_0llb.m4a.wctc")) returned 1 [0057.325] GetProcessHeap () returned 0x1130000 [0057.325] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.326] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 359 [0057.326] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.326] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108783f0, ftCreationTime.dwHighDateTime=0x1d4d098, ftLastAccessTime.dwLowDateTime=0x5659be80, ftLastAccessTime.dwHighDateTime=0x1d4d5a1, ftLastWriteTime.dwLowDateTime=0x5659be80, ftLastWriteTime.dwHighDateTime=0x1d4d5a1, nFileSizeHigh=0x0, nFileSizeLow=0x1339e, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="t9UrLv_AqJUN0R.m4a", cAlternateFileName="T9URLV~1.M4A")) returned 1 [0057.326] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\t9UrLv_AqJUN0R.m4a") returned 72 [0057.326] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\t9UrLv_AqJUN0R.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\t9urlv_aqjun0r.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.326] StrStrW (lpFirst="t9UrLv_AqJUN0R.m4a", lpSrch=".wctc") returned 0x0 [0057.326] GetProcessHeap () returned 0x1130000 [0057.326] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.326] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\t9UrLv_AqJUN0R.m4a.wctc") returned 77 [0057.326] CloseHandle (hObject=0x3c0) returned 1 [0057.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\t9UrLv_AqJUN0R.m4a" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\t9urlv_aqjun0r.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\t9UrLv_AqJUN0R.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\t9urlv_aqjun0r.m4a.wctc")) returned 1 [0057.326] GetProcessHeap () returned 0x1130000 [0057.326] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.326] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 360 [0057.326] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.326] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d15030, ftCreationTime.dwHighDateTime=0x1d4cf3d, ftLastAccessTime.dwLowDateTime=0x8e64080, ftLastAccessTime.dwHighDateTime=0x1d4d504, ftLastWriteTime.dwLowDateTime=0x8e64080, ftLastWriteTime.dwHighDateTime=0x1d4d504, nFileSizeHigh=0x0, nFileSizeLow=0x5781, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Xber9uoMEGIzKLfabXRe.wav", cAlternateFileName="XBER9U~1.WAV")) returned 1 [0057.327] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\Xber9uoMEGIzKLfabXRe.wav") returned 78 [0057.327] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\Xber9uoMEGIzKLfabXRe.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\xber9uomegizklfabxre.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.327] StrStrW (lpFirst="Xber9uoMEGIzKLfabXRe.wav", lpSrch=".wctc") returned 0x0 [0057.327] GetProcessHeap () returned 0x1130000 [0057.327] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.327] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\Xber9uoMEGIzKLfabXRe.wav.wctc") returned 83 [0057.327] CloseHandle (hObject=0x3c0) returned 1 [0057.327] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\Xber9uoMEGIzKLfabXRe.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\xber9uomegizklfabxre.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\Xber9uoMEGIzKLfabXRe.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\xber9uomegizklfabxre.wav.wctc")) returned 1 [0057.327] GetProcessHeap () returned 0x1130000 [0057.327] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.327] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 361 [0057.327] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.327] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd627a5d0, ftCreationTime.dwHighDateTime=0x1d4cd74, ftLastAccessTime.dwLowDateTime=0x93203df0, ftLastAccessTime.dwHighDateTime=0x1d4d1d5, ftLastWriteTime.dwLowDateTime=0x93203df0, ftLastWriteTime.dwHighDateTime=0x1d4d1d5, nFileSizeHigh=0x0, nFileSizeLow=0x17292, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="XDEj.mp3", cAlternateFileName="")) returned 1 [0057.327] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\XDEj.mp3") returned 62 [0057.327] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\XDEj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\xdej.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.328] StrStrW (lpFirst="XDEj.mp3", lpSrch=".wctc") returned 0x0 [0057.328] GetProcessHeap () returned 0x1130000 [0057.328] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.328] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\XDEj.mp3.wctc") returned 67 [0057.328] CloseHandle (hObject=0x3c0) returned 1 [0057.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\XDEj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\xdej.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\XDEj.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\xftxz5k\\xdej.mp3.wctc")) returned 1 [0057.328] GetProcessHeap () returned 0x1130000 [0057.328] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.328] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 362 [0057.328] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.328] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd627a5d0, ftCreationTime.dwHighDateTime=0x1d4cd74, ftLastAccessTime.dwLowDateTime=0x93203df0, ftLastAccessTime.dwHighDateTime=0x1d4d1d5, ftLastWriteTime.dwLowDateTime=0x93203df0, ftLastWriteTime.dwHighDateTime=0x1d4d1d5, nFileSizeHigh=0x0, nFileSizeLow=0x17292, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="xdej.mp3", cAlternateFileName="")) returned 0 [0057.328] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.328] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\XfTxZ5k\\read_me.txt") returned 65 [0057.328] GetProcessHeap () returned 0x1130000 [0057.328] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.328] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 143 [0057.328] GetProcessHeap () returned 0x1130000 [0057.328] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f101e0 | out: hHeap=0x1130000) returned 1 [0057.331] GetProcessHeap () returned 0x1130000 [0057.331] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3ee01c8 [0057.331] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\*") returned 37 [0057.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7949f0, ftCreationTime.dwHighDateTime=0x1d4d204, ftLastAccessTime.dwLowDateTime=0x6b921600, ftLastAccessTime.dwHighDateTime=0x1d4c5dc, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.332] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\.") returned 37 [0057.332] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7949f0, ftCreationTime.dwHighDateTime=0x1d4d204, ftLastAccessTime.dwLowDateTime=0x6b921600, ftLastAccessTime.dwHighDateTime=0x1d4c5dc, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.332] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\..") returned 38 [0057.332] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c78340, ftCreationTime.dwHighDateTime=0x1d4c89d, ftLastAccessTime.dwLowDateTime=0x74881860, ftLastAccessTime.dwHighDateTime=0x1d4cb52, ftLastWriteTime.dwLowDateTime=0x74881860, ftLastWriteTime.dwHighDateTime=0x1d4cb52, nFileSizeHigh=0x0, nFileSizeLow=0x46b3, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="6dw3.wav", cAlternateFileName="")) returned 1 [0057.332] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6dw3.wav") returned 44 [0057.332] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6dw3.wav" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\6dw3.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.332] StrStrW (lpFirst="6dw3.wav", lpSrch=".wctc") returned 0x0 [0057.332] GetProcessHeap () returned 0x1130000 [0057.332] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.333] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6dw3.wav.wctc") returned 49 [0057.333] CloseHandle (hObject=0x3c0) returned 1 [0057.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6dw3.wav" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\6dw3.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6dw3.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\6dw3.wav.wctc")) returned 1 [0057.339] GetProcessHeap () returned 0x1130000 [0057.339] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.339] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 363 [0057.339] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.339] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3447f0e0, ftCreationTime.dwHighDateTime=0x1d4ce81, ftLastAccessTime.dwLowDateTime=0x77b58c40, ftLastAccessTime.dwHighDateTime=0x1d4cc9f, ftLastWriteTime.dwLowDateTime=0x77b58c40, ftLastWriteTime.dwHighDateTime=0x1d4cc9f, nFileSizeHigh=0x0, nFileSizeLow=0xcb50, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="6JgbAZx.m4a", cAlternateFileName="")) returned 1 [0057.339] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6JgbAZx.m4a") returned 47 [0057.339] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6JgbAZx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\6jgbazx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.339] StrStrW (lpFirst="6JgbAZx.m4a", lpSrch=".wctc") returned 0x0 [0057.339] GetProcessHeap () returned 0x1130000 [0057.339] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.339] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6JgbAZx.m4a.wctc") returned 52 [0057.339] CloseHandle (hObject=0x3c0) returned 1 [0057.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6JgbAZx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\6jgbazx.m4a"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\6JgbAZx.m4a.wctc" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\6jgbazx.m4a.wctc")) returned 1 [0057.340] GetProcessHeap () returned 0x1130000 [0057.340] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.340] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 364 [0057.340] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.340] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a85c90, ftCreationTime.dwHighDateTime=0x1d4d0c9, ftLastAccessTime.dwLowDateTime=0x3c706740, ftLastAccessTime.dwHighDateTime=0x1d4d43d, ftLastWriteTime.dwLowDateTime=0x3c706740, ftLastWriteTime.dwHighDateTime=0x1d4d43d, nFileSizeHigh=0x0, nFileSizeLow=0x8ce2, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="dn6-3.mp3", cAlternateFileName="")) returned 1 [0057.340] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\dn6-3.mp3") returned 45 [0057.340] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\dn6-3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\dn6-3.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.340] StrStrW (lpFirst="dn6-3.mp3", lpSrch=".wctc") returned 0x0 [0057.340] GetProcessHeap () returned 0x1130000 [0057.340] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.340] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\dn6-3.mp3.wctc") returned 50 [0057.340] CloseHandle (hObject=0x3c0) returned 1 [0057.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\dn6-3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\dn6-3.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\dn6-3.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\dn6-3.mp3.wctc")) returned 1 [0057.341] GetProcessHeap () returned 0x1130000 [0057.341] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.341] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 365 [0057.341] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.341] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30c1ee4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30c1ee4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.341] wnsprintfW (in: pszDest=0x3ee01c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\read_me.txt") returned 47 [0057.341] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\5j6qS2RSr\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\5j6qs2rsr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.341] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.341] GetProcessHeap () returned 0x1130000 [0057.341] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ee01c8 | out: hHeap=0x1130000) returned 1 [0057.343] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 145 [0057.343] GetProcessHeap () returned 0x1130000 [0057.343] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3ef01d0 | out: hHeap=0x1130000) returned 1 [0057.346] GetProcessHeap () returned 0x1130000 [0057.346] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.347] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NetHood\\*") returned 29 [0057.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30c1ee4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30c1ee4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0057.347] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\NetHood\\read_me.txt") returned 39 [0057.347] GetProcessHeap () returned 0x1130000 [0057.347] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.347] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 146 [0057.347] GetProcessHeap () returned 0x1130000 [0057.347] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70210 | out: hHeap=0x1130000) returned 1 [0057.347] GetProcessHeap () returned 0x1130000 [0057.347] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.348] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\OneDrive\\*") returned 30 [0057.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0057.348] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\OneDrive\\.") returned 30 [0057.348] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.348] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\OneDrive\\..") returned 31 [0057.348] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.348] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned 40 [0057.348] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.348] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.348] GetProcessHeap () returned 0x1130000 [0057.348] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.348] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 147 [0057.348] GetProcessHeap () returned 0x1130000 [0057.348] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3870090 | out: hHeap=0x1130000) returned 1 [0057.349] GetProcessHeap () returned 0x1130000 [0057.349] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.350] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\*") returned 30 [0057.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d5efd9, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d5efd9, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.350] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\.") returned 30 [0057.350] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf2d5efd9, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d5efd9, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.350] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\..") returned 31 [0057.350] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d9469f0, ftCreationTime.dwHighDateTime=0x1d4c80b, ftLastAccessTime.dwLowDateTime=0xe9111280, ftLastAccessTime.dwHighDateTime=0x1d4cd8d, ftLastWriteTime.dwLowDateTime=0xe9111280, ftLastWriteTime.dwHighDateTime=0x1d4cd8d, nFileSizeHigh=0x0, nFileSizeLow=0x75cf, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="-1um.bmp", cAlternateFileName="")) returned 1 [0057.350] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\-1um.bmp") returned 37 [0057.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\-1um.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-1um.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.351] StrStrW (lpFirst="-1um.bmp", lpSrch=".wctc") returned 0x0 [0057.351] GetProcessHeap () returned 0x1130000 [0057.351] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.352] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\-1um.bmp.wctc") returned 42 [0057.352] CloseHandle (hObject=0x3c0) returned 1 [0057.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\-1um.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-1um.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\-1um.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\-1um.bmp.wctc")) returned 1 [0057.352] GetProcessHeap () returned 0x1130000 [0057.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.352] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 366 [0057.352] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.352] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68818a0, ftCreationTime.dwHighDateTime=0x1d4d2ce, ftLastAccessTime.dwLowDateTime=0xa0a38600, ftLastAccessTime.dwHighDateTime=0x1d4ce4a, ftLastWriteTime.dwLowDateTime=0xa0a38600, ftLastWriteTime.dwHighDateTime=0x1d4ce4a, nFileSizeHigh=0x0, nFileSizeLow=0xf0b9, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="1968To6BGO5.png", cAlternateFileName="1968TO~1.PNG")) returned 1 [0057.352] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\1968To6BGO5.png") returned 44 [0057.352] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\1968To6BGO5.png" (normalized: "c:\\users\\fd1hvy\\pictures\\1968to6bgo5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.352] StrStrW (lpFirst="1968To6BGO5.png", lpSrch=".wctc") returned 0x0 [0057.352] GetProcessHeap () returned 0x1130000 [0057.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.352] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\1968To6BGO5.png.wctc") returned 49 [0057.352] CloseHandle (hObject=0x3c0) returned 1 [0057.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\1968To6BGO5.png" (normalized: "c:\\users\\fd1hvy\\pictures\\1968to6bgo5.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\1968To6BGO5.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\1968to6bgo5.png.wctc")) returned 1 [0057.353] GetProcessHeap () returned 0x1130000 [0057.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.353] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 367 [0057.353] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.353] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a327b0, ftCreationTime.dwHighDateTime=0x1d4cdcb, ftLastAccessTime.dwLowDateTime=0x76e0f020, ftLastAccessTime.dwHighDateTime=0x1d4d06e, ftLastWriteTime.dwLowDateTime=0x76e0f020, ftLastWriteTime.dwHighDateTime=0x1d4d06e, nFileSizeHigh=0x0, nFileSizeLow=0x39ae, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="2va9Wdb5W2Uu.gif", cAlternateFileName="2VA9WD~1.GIF")) returned 1 [0057.353] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\2va9Wdb5W2Uu.gif") returned 45 [0057.353] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\2va9Wdb5W2Uu.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\2va9wdb5w2uu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.353] StrStrW (lpFirst="2va9Wdb5W2Uu.gif", lpSrch=".wctc") returned 0x0 [0057.353] GetProcessHeap () returned 0x1130000 [0057.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.353] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\2va9Wdb5W2Uu.gif.wctc") returned 50 [0057.353] CloseHandle (hObject=0x3c0) returned 1 [0057.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\2va9Wdb5W2Uu.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\2va9wdb5w2uu.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\2va9Wdb5W2Uu.gif.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\2va9wdb5w2uu.gif.wctc")) returned 1 [0057.354] GetProcessHeap () returned 0x1130000 [0057.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.354] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 368 [0057.354] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.354] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61549620, ftCreationTime.dwHighDateTime=0x1d4ca43, ftLastAccessTime.dwLowDateTime=0x95fbf7d0, ftLastAccessTime.dwHighDateTime=0x1d4c77b, ftLastWriteTime.dwLowDateTime=0x95fbf7d0, ftLastWriteTime.dwHighDateTime=0x1d4c77b, nFileSizeHigh=0x0, nFileSizeLow=0x7d62, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="4tF2 NNGtZ2pkJ-G.png", cAlternateFileName="4TF2NN~1.PNG")) returned 1 [0057.354] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\4tF2 NNGtZ2pkJ-G.png") returned 49 [0057.354] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\4tF2 NNGtZ2pkJ-G.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4tf2 nngtz2pkj-g.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.354] StrStrW (lpFirst="4tF2 NNGtZ2pkJ-G.png", lpSrch=".wctc") returned 0x0 [0057.354] GetProcessHeap () returned 0x1130000 [0057.354] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.354] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\4tF2 NNGtZ2pkJ-G.png.wctc") returned 54 [0057.354] CloseHandle (hObject=0x3c0) returned 1 [0057.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\4tF2 NNGtZ2pkJ-G.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4tf2 nngtz2pkj-g.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\4tF2 NNGtZ2pkJ-G.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\4tf2 nngtz2pkj-g.png.wctc")) returned 1 [0057.355] GetProcessHeap () returned 0x1130000 [0057.355] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.355] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 369 [0057.355] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.355] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0a20, ftCreationTime.dwHighDateTime=0x1d4cf8a, ftLastAccessTime.dwLowDateTime=0x1ed12620, ftLastAccessTime.dwHighDateTime=0x1d4d127, ftLastWriteTime.dwLowDateTime=0x1ed12620, ftLastWriteTime.dwHighDateTime=0x1d4d127, nFileSizeHigh=0x0, nFileSizeLow=0x6127, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="5inaBI.bmp", cAlternateFileName="")) returned 1 [0057.355] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5inaBI.bmp") returned 39 [0057.355] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5inaBI.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\5inabi.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.355] StrStrW (lpFirst="5inaBI.bmp", lpSrch=".wctc") returned 0x0 [0057.355] GetProcessHeap () returned 0x1130000 [0057.355] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.355] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5inaBI.bmp.wctc") returned 44 [0057.355] CloseHandle (hObject=0x3c0) returned 1 [0057.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5inaBI.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\5inabi.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5inaBI.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\5inabi.bmp.wctc")) returned 1 [0057.356] GetProcessHeap () returned 0x1130000 [0057.356] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.356] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 370 [0057.356] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.356] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63628f70, ftCreationTime.dwHighDateTime=0x1d4d313, ftLastAccessTime.dwLowDateTime=0xaa20e140, ftLastAccessTime.dwHighDateTime=0x1d4d0d5, ftLastWriteTime.dwLowDateTime=0xaa20e140, ftLastWriteTime.dwHighDateTime=0x1d4d0d5, nFileSizeHigh=0x0, nFileSizeLow=0x11ec6, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="5PwdV6ub-sQy.png", cAlternateFileName="5PWDV6~1.PNG")) returned 1 [0057.356] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5PwdV6ub-sQy.png") returned 45 [0057.356] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5PwdV6ub-sQy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5pwdv6ub-sqy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.356] StrStrW (lpFirst="5PwdV6ub-sQy.png", lpSrch=".wctc") returned 0x0 [0057.356] GetProcessHeap () returned 0x1130000 [0057.356] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.356] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5PwdV6ub-sQy.png.wctc") returned 50 [0057.356] CloseHandle (hObject=0x3c0) returned 1 [0057.357] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5PwdV6ub-sQy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5pwdv6ub-sqy.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\5PwdV6ub-sQy.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\5pwdv6ub-sqy.png.wctc")) returned 1 [0057.357] GetProcessHeap () returned 0x1130000 [0057.357] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.357] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 371 [0057.357] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.357] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907d9a30, ftCreationTime.dwHighDateTime=0x1d4d2d3, ftLastAccessTime.dwLowDateTime=0xea201bb0, ftLastAccessTime.dwHighDateTime=0x1d4cd44, ftLastWriteTime.dwLowDateTime=0xea201bb0, ftLastWriteTime.dwHighDateTime=0x1d4cd44, nFileSizeHigh=0x0, nFileSizeLow=0xd70a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="64XqXUs1bhjFgUu Q_.bmp", cAlternateFileName="64XQXU~1.BMP")) returned 1 [0057.357] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\64XqXUs1bhjFgUu Q_.bmp") returned 51 [0057.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\64XqXUs1bhjFgUu Q_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\64xqxus1bhjfguu q_.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.357] StrStrW (lpFirst="64XqXUs1bhjFgUu Q_.bmp", lpSrch=".wctc") returned 0x0 [0057.357] GetProcessHeap () returned 0x1130000 [0057.357] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.357] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\64XqXUs1bhjFgUu Q_.bmp.wctc") returned 56 [0057.357] CloseHandle (hObject=0x3c0) returned 1 [0057.357] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\64XqXUs1bhjFgUu Q_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\64xqxus1bhjfguu q_.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\64XqXUs1bhjFgUu Q_.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\64xqxus1bhjfguu q_.bmp.wctc")) returned 1 [0057.358] GetProcessHeap () returned 0x1130000 [0057.358] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.358] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 372 [0057.358] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.358] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b83590, ftCreationTime.dwHighDateTime=0x1d4d374, ftLastAccessTime.dwLowDateTime=0x618d4a60, ftLastAccessTime.dwHighDateTime=0x1d4d4ac, ftLastWriteTime.dwLowDateTime=0x618d4a60, ftLastWriteTime.dwHighDateTime=0x1d4d4ac, nFileSizeHigh=0x0, nFileSizeLow=0xe29d, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="6FSJqm3OA-5HC1ZmbA.png", cAlternateFileName="6FSJQM~1.PNG")) returned 1 [0057.358] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\6FSJqm3OA-5HC1ZmbA.png") returned 51 [0057.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\6FSJqm3OA-5HC1ZmbA.png" (normalized: "c:\\users\\fd1hvy\\pictures\\6fsjqm3oa-5hc1zmba.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.358] StrStrW (lpFirst="6FSJqm3OA-5HC1ZmbA.png", lpSrch=".wctc") returned 0x0 [0057.358] GetProcessHeap () returned 0x1130000 [0057.358] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.358] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\6FSJqm3OA-5HC1ZmbA.png.wctc") returned 56 [0057.358] CloseHandle (hObject=0x3c0) returned 1 [0057.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\6FSJqm3OA-5HC1ZmbA.png" (normalized: "c:\\users\\fd1hvy\\pictures\\6fsjqm3oa-5hc1zmba.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\6FSJqm3OA-5HC1ZmbA.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\6fsjqm3oa-5hc1zmba.png.wctc")) returned 1 [0057.359] GetProcessHeap () returned 0x1130000 [0057.359] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.359] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 373 [0057.359] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.359] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0057.359] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned 40 [0057.359] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.359] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned 40 [0057.359] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.359] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.359] GetProcessHeap () returned 0x1130000 [0057.359] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.359] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\eM1Uk-X0.png.wctc") returned 46 [0057.359] CloseHandle (hObject=0x3c0) returned 1 [0057.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\eM1Uk-X0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\em1uk-x0.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\eM1Uk-X0.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\em1uk-x0.png.wctc")) returned 1 [0057.360] GetProcessHeap () returned 0x1130000 [0057.360] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.360] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 374 [0057.360] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.360] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16a23ed0, ftCreationTime.dwHighDateTime=0x1d4c844, ftLastAccessTime.dwLowDateTime=0xb81f19f0, ftLastAccessTime.dwHighDateTime=0x1d4c84d, ftLastWriteTime.dwLowDateTime=0xb81f19f0, ftLastWriteTime.dwHighDateTime=0x1d4c84d, nFileSizeHigh=0x0, nFileSizeLow=0x174bb, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="fGWdn09l9jZ6UZ.bmp", cAlternateFileName="FGWDN0~1.BMP")) returned 1 [0057.360] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\fGWdn09l9jZ6UZ.bmp") returned 47 [0057.360] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\fGWdn09l9jZ6UZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\fgwdn09l9jz6uz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.360] StrStrW (lpFirst="fGWdn09l9jZ6UZ.bmp", lpSrch=".wctc") returned 0x0 [0057.360] GetProcessHeap () returned 0x1130000 [0057.360] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.360] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\fGWdn09l9jZ6UZ.bmp.wctc") returned 52 [0057.360] CloseHandle (hObject=0x3c0) returned 1 [0057.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\fGWdn09l9jZ6UZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\fgwdn09l9jz6uz.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\fGWdn09l9jZ6UZ.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\fgwdn09l9jz6uz.bmp.wctc")) returned 1 [0057.361] GetProcessHeap () returned 0x1130000 [0057.361] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.361] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 375 [0057.361] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.361] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ced4490, ftCreationTime.dwHighDateTime=0x1d4cf71, ftLastAccessTime.dwLowDateTime=0xb23625b0, ftLastAccessTime.dwHighDateTime=0x1d4cac8, ftLastWriteTime.dwLowDateTime=0xb23625b0, ftLastWriteTime.dwHighDateTime=0x1d4cac8, nFileSizeHigh=0x0, nFileSizeLow=0xea04, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="gxK2TMspVe zS9O.png", cAlternateFileName="GXK2TM~1.PNG")) returned 1 [0057.361] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\gxK2TMspVe zS9O.png") returned 48 [0057.361] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\gxK2TMspVe zS9O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\gxk2tmspve zs9o.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.361] StrStrW (lpFirst="gxK2TMspVe zS9O.png", lpSrch=".wctc") returned 0x0 [0057.361] GetProcessHeap () returned 0x1130000 [0057.361] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.361] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\gxK2TMspVe zS9O.png.wctc") returned 53 [0057.361] CloseHandle (hObject=0x3c0) returned 1 [0057.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\gxK2TMspVe zS9O.png" (normalized: "c:\\users\\fd1hvy\\pictures\\gxk2tmspve zs9o.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\gxK2TMspVe zS9O.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\gxk2tmspve zs9o.png.wctc")) returned 1 [0057.362] GetProcessHeap () returned 0x1130000 [0057.362] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.362] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 376 [0057.362] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.362] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f2cdd0, ftCreationTime.dwHighDateTime=0x1d4caf2, ftLastAccessTime.dwLowDateTime=0xce0e2b90, ftLastAccessTime.dwHighDateTime=0x1d4cc42, ftLastWriteTime.dwLowDateTime=0xce0e2b90, ftLastWriteTime.dwHighDateTime=0x1d4cc42, nFileSizeHigh=0x0, nFileSizeLow=0xdaf2, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="hULtTm S.gif", cAlternateFileName="HULTTM~1.GIF")) returned 1 [0057.362] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\hULtTm S.gif") returned 42 [0057.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\hULtTm S.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\hulttm s.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.362] StrStrW (lpFirst="hULtTm S.gif", lpSrch=".wctc") returned 0x0 [0057.362] GetProcessHeap () returned 0x1130000 [0057.362] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.362] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\hULtTm S.gif.wctc") returned 47 [0057.362] CloseHandle (hObject=0x3c0) returned 1 [0057.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\hULtTm S.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\hulttm s.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\hULtTm S.gif.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\hulttm s.gif.wctc")) returned 1 [0057.363] GetProcessHeap () returned 0x1130000 [0057.363] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.363] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 377 [0057.363] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.363] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e0ab190, ftCreationTime.dwHighDateTime=0x1d4d1d9, ftLastAccessTime.dwLowDateTime=0xae04d6c0, ftLastAccessTime.dwHighDateTime=0x1d4cc36, ftLastWriteTime.dwLowDateTime=0xae04d6c0, ftLastWriteTime.dwHighDateTime=0x1d4cc36, nFileSizeHigh=0x0, nFileSizeLow=0x534a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="I5de.png", cAlternateFileName="")) returned 1 [0057.363] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\I5de.png") returned 37 [0057.363] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\I5de.png" (normalized: "c:\\users\\fd1hvy\\pictures\\i5de.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.363] StrStrW (lpFirst="I5de.png", lpSrch=".wctc") returned 0x0 [0057.363] GetProcessHeap () returned 0x1130000 [0057.363] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.363] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\I5de.png.wctc") returned 42 [0057.363] CloseHandle (hObject=0x3c0) returned 1 [0057.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\I5de.png" (normalized: "c:\\users\\fd1hvy\\pictures\\i5de.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\I5de.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\i5de.png.wctc")) returned 1 [0057.364] GetProcessHeap () returned 0x1130000 [0057.364] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.364] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 378 [0057.364] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.364] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa06d8230, ftCreationTime.dwHighDateTime=0x1d4ca76, ftLastAccessTime.dwLowDateTime=0xeab97050, ftLastAccessTime.dwHighDateTime=0x1d4cd56, ftLastWriteTime.dwLowDateTime=0xeab97050, ftLastWriteTime.dwHighDateTime=0x1d4cd56, nFileSizeHigh=0x0, nFileSizeLow=0x17a73, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="InF0j ztbn378.jpg", cAlternateFileName="INF0JZ~1.JPG")) returned 1 [0057.364] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\InF0j ztbn378.jpg") returned 46 [0057.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\InF0j ztbn378.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\inf0j ztbn378.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.364] StrStrW (lpFirst="InF0j ztbn378.jpg", lpSrch=".wctc") returned 0x0 [0057.364] GetProcessHeap () returned 0x1130000 [0057.364] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.364] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\InF0j ztbn378.jpg.wctc") returned 51 [0057.364] CloseHandle (hObject=0x3c0) returned 1 [0057.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\InF0j ztbn378.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\inf0j ztbn378.jpg"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\InF0j ztbn378.jpg.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\inf0j ztbn378.jpg.wctc")) returned 1 [0057.365] GetProcessHeap () returned 0x1130000 [0057.365] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.365] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 379 [0057.365] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.365] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e673a0, ftCreationTime.dwHighDateTime=0x1d4d0a7, ftLastAccessTime.dwLowDateTime=0x2340f5c0, ftLastAccessTime.dwHighDateTime=0x1d4d20b, ftLastWriteTime.dwLowDateTime=0x2340f5c0, ftLastWriteTime.dwHighDateTime=0x1d4d20b, nFileSizeHigh=0x0, nFileSizeLow=0x294f, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="K61Cmx9_-gNehj G3hS.bmp", cAlternateFileName="K61CMX~1.BMP")) returned 1 [0057.365] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\K61Cmx9_-gNehj G3hS.bmp") returned 52 [0057.365] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\K61Cmx9_-gNehj G3hS.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\k61cmx9_-gnehj g3hs.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.365] StrStrW (lpFirst="K61Cmx9_-gNehj G3hS.bmp", lpSrch=".wctc") returned 0x0 [0057.365] GetProcessHeap () returned 0x1130000 [0057.365] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.365] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\K61Cmx9_-gNehj G3hS.bmp.wctc") returned 57 [0057.365] CloseHandle (hObject=0x3c0) returned 1 [0057.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\K61Cmx9_-gNehj G3hS.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\k61cmx9_-gnehj g3hs.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\K61Cmx9_-gNehj G3hS.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\k61cmx9_-gnehj g3hs.bmp.wctc")) returned 1 [0057.368] GetProcessHeap () returned 0x1130000 [0057.368] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.368] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 380 [0057.368] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.368] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4d38c0, ftCreationTime.dwHighDateTime=0x1d4d18b, ftLastAccessTime.dwLowDateTime=0xa3389e50, ftLastAccessTime.dwHighDateTime=0x1d4cb61, ftLastWriteTime.dwLowDateTime=0xa3389e50, ftLastWriteTime.dwHighDateTime=0x1d4cb61, nFileSizeHigh=0x0, nFileSizeLow=0x14754, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="k7mxuk4-gd.png", cAlternateFileName="K7MXUK~1.PNG")) returned 1 [0057.368] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\k7mxuk4-gd.png") returned 43 [0057.369] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\k7mxuk4-gd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\k7mxuk4-gd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.369] StrStrW (lpFirst="k7mxuk4-gd.png", lpSrch=".wctc") returned 0x0 [0057.369] GetProcessHeap () returned 0x1130000 [0057.369] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.369] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\k7mxuk4-gd.png.wctc") returned 48 [0057.369] CloseHandle (hObject=0x3c0) returned 1 [0057.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\k7mxuk4-gd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\k7mxuk4-gd.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\k7mxuk4-gd.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\k7mxuk4-gd.png.wctc")) returned 1 [0057.369] GetProcessHeap () returned 0x1130000 [0057.369] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.369] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 381 [0057.369] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.369] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d40e0, ftCreationTime.dwHighDateTime=0x1d4cd5a, ftLastAccessTime.dwLowDateTime=0x48a0ef40, ftLastAccessTime.dwHighDateTime=0x1d4c5eb, ftLastWriteTime.dwLowDateTime=0x48a0ef40, ftLastWriteTime.dwHighDateTime=0x1d4c5eb, nFileSizeHigh=0x0, nFileSizeLow=0xed4e, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="kaVD3whEt7W8H.jpg", cAlternateFileName="KAVD3W~1.JPG")) returned 1 [0057.369] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\kaVD3whEt7W8H.jpg") returned 46 [0057.369] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\kaVD3whEt7W8H.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kavd3whet7w8h.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.370] StrStrW (lpFirst="kaVD3whEt7W8H.jpg", lpSrch=".wctc") returned 0x0 [0057.370] GetProcessHeap () returned 0x1130000 [0057.370] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.370] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\kaVD3whEt7W8H.jpg.wctc") returned 51 [0057.370] CloseHandle (hObject=0x3c0) returned 1 [0057.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\kaVD3whEt7W8H.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\kavd3whet7w8h.jpg"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\kaVD3whEt7W8H.jpg.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\kavd3whet7w8h.jpg.wctc")) returned 1 [0057.370] GetProcessHeap () returned 0x1130000 [0057.370] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.370] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 382 [0057.370] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.370] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97ca210, ftCreationTime.dwHighDateTime=0x1d4d380, ftLastAccessTime.dwLowDateTime=0x78ab5a70, ftLastAccessTime.dwHighDateTime=0x1d4d551, ftLastWriteTime.dwLowDateTime=0x78ab5a70, ftLastWriteTime.dwHighDateTime=0x1d4d551, nFileSizeHigh=0x0, nFileSizeLow=0x8afd, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ME2J.png", cAlternateFileName="")) returned 1 [0057.370] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ME2J.png") returned 37 [0057.370] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ME2J.png" (normalized: "c:\\users\\fd1hvy\\pictures\\me2j.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.370] StrStrW (lpFirst="ME2J.png", lpSrch=".wctc") returned 0x0 [0057.371] GetProcessHeap () returned 0x1130000 [0057.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.371] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ME2J.png.wctc") returned 42 [0057.371] CloseHandle (hObject=0x3c0) returned 1 [0057.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ME2J.png" (normalized: "c:\\users\\fd1hvy\\pictures\\me2j.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ME2J.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\me2j.png.wctc")) returned 1 [0057.371] GetProcessHeap () returned 0x1130000 [0057.371] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.371] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 383 [0057.371] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.371] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782edee0, ftCreationTime.dwHighDateTime=0x1d4d48a, ftLastAccessTime.dwLowDateTime=0x2aacc6f0, ftLastAccessTime.dwHighDateTime=0x1d4c670, ftLastWriteTime.dwLowDateTime=0x2aacc6f0, ftLastWriteTime.dwHighDateTime=0x1d4c670, nFileSizeHigh=0x0, nFileSizeLow=0x5975, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="oFc5qyTQZwQKOWz9C.gif", cAlternateFileName="OFC5QY~1.GIF")) returned 1 [0057.371] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\oFc5qyTQZwQKOWz9C.gif") returned 50 [0057.371] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\oFc5qyTQZwQKOWz9C.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ofc5qytqzwqkowz9c.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.371] StrStrW (lpFirst="oFc5qyTQZwQKOWz9C.gif", lpSrch=".wctc") returned 0x0 [0057.371] GetProcessHeap () returned 0x1130000 [0057.371] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.371] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\oFc5qyTQZwQKOWz9C.gif.wctc") returned 55 [0057.372] CloseHandle (hObject=0x3c0) returned 1 [0057.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\oFc5qyTQZwQKOWz9C.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ofc5qytqzwqkowz9c.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\oFc5qyTQZwQKOWz9C.gif.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\ofc5qytqzwqkowz9c.gif.wctc")) returned 1 [0057.384] GetProcessHeap () returned 0x1130000 [0057.384] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.384] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 384 [0057.384] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.384] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10325770, ftCreationTime.dwHighDateTime=0x1d4c9e7, ftLastAccessTime.dwLowDateTime=0x5b2c2600, ftLastAccessTime.dwHighDateTime=0x1d4d02e, ftLastWriteTime.dwLowDateTime=0x5b2c2600, ftLastWriteTime.dwHighDateTime=0x1d4d02e, nFileSizeHigh=0x0, nFileSizeLow=0xdd06, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="P613od.bmp", cAlternateFileName="")) returned 1 [0057.384] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\P613od.bmp") returned 39 [0057.384] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\P613od.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\p613od.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.384] StrStrW (lpFirst="P613od.bmp", lpSrch=".wctc") returned 0x0 [0057.384] GetProcessHeap () returned 0x1130000 [0057.384] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.384] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\P613od.bmp.wctc") returned 44 [0057.384] CloseHandle (hObject=0x3c0) returned 1 [0057.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\P613od.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\p613od.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\P613od.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\p613od.bmp.wctc")) returned 1 [0057.384] GetProcessHeap () returned 0x1130000 [0057.385] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.385] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 385 [0057.385] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.385] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc06bd120, ftCreationTime.dwHighDateTime=0x1d4c5b9, ftLastAccessTime.dwLowDateTime=0x463a4ec0, ftLastAccessTime.dwHighDateTime=0x1d4d18c, ftLastWriteTime.dwLowDateTime=0x463a4ec0, ftLastWriteTime.dwHighDateTime=0x1d4d18c, nFileSizeHigh=0x0, nFileSizeLow=0xf3fc, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="pBakXSEZuQ3i5Nd.gif", cAlternateFileName="PBAKXS~1.GIF")) returned 1 [0057.385] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\pBakXSEZuQ3i5Nd.gif") returned 48 [0057.385] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\pBakXSEZuQ3i5Nd.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pbakxsezuq3i5nd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.385] StrStrW (lpFirst="pBakXSEZuQ3i5Nd.gif", lpSrch=".wctc") returned 0x0 [0057.385] GetProcessHeap () returned 0x1130000 [0057.385] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.385] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\pBakXSEZuQ3i5Nd.gif.wctc") returned 53 [0057.385] CloseHandle (hObject=0x3c0) returned 1 [0057.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\pBakXSEZuQ3i5Nd.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pbakxsezuq3i5nd.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\pBakXSEZuQ3i5Nd.gif.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\pbakxsezuq3i5nd.gif.wctc")) returned 1 [0057.385] GetProcessHeap () returned 0x1130000 [0057.385] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.385] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 386 [0057.385] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.385] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50efade0, ftCreationTime.dwHighDateTime=0x1d4c76b, ftLastAccessTime.dwLowDateTime=0x6111ca10, ftLastAccessTime.dwHighDateTime=0x1d4d241, ftLastWriteTime.dwLowDateTime=0x6111ca10, ftLastWriteTime.dwHighDateTime=0x1d4d241, nFileSizeHigh=0x0, nFileSizeLow=0x8f2c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Ph1zzJs.bmp", cAlternateFileName="")) returned 1 [0057.385] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Ph1zzJs.bmp") returned 40 [0057.386] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Ph1zzJs.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ph1zzjs.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.386] StrStrW (lpFirst="Ph1zzJs.bmp", lpSrch=".wctc") returned 0x0 [0057.386] GetProcessHeap () returned 0x1130000 [0057.386] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.386] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Ph1zzJs.bmp.wctc") returned 45 [0057.386] CloseHandle (hObject=0x3c0) returned 1 [0057.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Ph1zzJs.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ph1zzjs.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Ph1zzJs.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\ph1zzjs.bmp.wctc")) returned 1 [0057.386] GetProcessHeap () returned 0x1130000 [0057.386] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.386] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 387 [0057.386] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.386] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc20700a0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xbd40a780, ftLastAccessTime.dwHighDateTime=0x1d4ca5c, ftLastWriteTime.dwLowDateTime=0xbd40a780, ftLastWriteTime.dwHighDateTime=0x1d4ca5c, nFileSizeHigh=0x0, nFileSizeLow=0xc99d, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="qs UsBEnajx0.jpg", cAlternateFileName="QSUSBE~1.JPG")) returned 1 [0057.386] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\qs UsBEnajx0.jpg") returned 45 [0057.386] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\qs UsBEnajx0.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qs usbenajx0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.387] StrStrW (lpFirst="qs UsBEnajx0.jpg", lpSrch=".wctc") returned 0x0 [0057.387] GetProcessHeap () returned 0x1130000 [0057.387] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.387] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\qs UsBEnajx0.jpg.wctc") returned 50 [0057.387] CloseHandle (hObject=0x3c0) returned 1 [0057.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\qs UsBEnajx0.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qs usbenajx0.jpg"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\qs UsBEnajx0.jpg.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\qs usbenajx0.jpg.wctc")) returned 1 [0057.387] GetProcessHeap () returned 0x1130000 [0057.387] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.387] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 388 [0057.387] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.387] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d5efd9, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2d5efd9, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2d5efd9, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.387] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\read_me.txt") returned 40 [0057.387] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.388] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.388] GetProcessHeap () returned 0x1130000 [0057.388] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.388] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\rwr9IwC8CY0dHjz1.jpg.wctc") returned 54 [0057.388] CloseHandle (hObject=0x3c0) returned 1 [0057.388] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\rwr9IwC8CY0dHjz1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rwr9iwc8cy0dhjz1.jpg"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\rwr9IwC8CY0dHjz1.jpg.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\rwr9iwc8cy0dhjz1.jpg.wctc")) returned 1 [0057.388] GetProcessHeap () returned 0x1130000 [0057.388] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.388] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 389 [0057.388] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.389] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0057.389] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned 43 [0057.389] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa472c7c0, ftCreationTime.dwHighDateTime=0x1d4ce9d, ftLastAccessTime.dwLowDateTime=0x35c0ee80, ftLastAccessTime.dwHighDateTime=0x1d4d1b1, ftLastWriteTime.dwLowDateTime=0x35c0ee80, ftLastWriteTime.dwHighDateTime=0x1d4d1b1, nFileSizeHigh=0x0, nFileSizeLow=0xfa11, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="SNGc8TcGqU.jpg", cAlternateFileName="SNGC8T~1.JPG")) returned 1 [0057.389] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\SNGc8TcGqU.jpg") returned 43 [0057.389] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\SNGc8TcGqU.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\sngc8tcgqu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.389] StrStrW (lpFirst="SNGc8TcGqU.jpg", lpSrch=".wctc") returned 0x0 [0057.389] GetProcessHeap () returned 0x1130000 [0057.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.389] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\SNGc8TcGqU.jpg.wctc") returned 48 [0057.389] CloseHandle (hObject=0x3c0) returned 1 [0057.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\SNGc8TcGqU.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\sngc8tcgqu.jpg"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\SNGc8TcGqU.jpg.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\sngc8tcgqu.jpg.wctc")) returned 1 [0057.389] GetProcessHeap () returned 0x1130000 [0057.389] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.389] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 390 [0057.389] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.389] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bf8f860, ftCreationTime.dwHighDateTime=0x1d4cb5f, ftLastAccessTime.dwLowDateTime=0xad826360, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0xad826360, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0xa291, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="sXPcvI4GR.bmp", cAlternateFileName="SXPCVI~1.BMP")) returned 1 [0057.389] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\sXPcvI4GR.bmp") returned 42 [0057.390] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\sXPcvI4GR.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sxpcvi4gr.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.390] StrStrW (lpFirst="sXPcvI4GR.bmp", lpSrch=".wctc") returned 0x0 [0057.390] GetProcessHeap () returned 0x1130000 [0057.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.390] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\sXPcvI4GR.bmp.wctc") returned 47 [0057.390] CloseHandle (hObject=0x3c0) returned 1 [0057.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\sXPcvI4GR.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sxpcvi4gr.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\sXPcvI4GR.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\sxpcvi4gr.bmp.wctc")) returned 1 [0057.390] GetProcessHeap () returned 0x1130000 [0057.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.390] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 391 [0057.390] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.390] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa385ccb0, ftCreationTime.dwHighDateTime=0x1d4c9dc, ftLastAccessTime.dwLowDateTime=0x44abcfa0, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x44abcfa0, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x8980, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="TFz_.gif", cAlternateFileName="")) returned 1 [0057.391] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TFz_.gif") returned 37 [0057.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TFz_.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\tfz_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.391] StrStrW (lpFirst="TFz_.gif", lpSrch=".wctc") returned 0x0 [0057.391] GetProcessHeap () returned 0x1130000 [0057.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.391] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TFz_.gif.wctc") returned 42 [0057.391] CloseHandle (hObject=0x3c0) returned 1 [0057.391] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TFz_.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\tfz_.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TFz_.gif.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\tfz_.gif.wctc")) returned 1 [0057.391] GetProcessHeap () returned 0x1130000 [0057.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.391] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 392 [0057.391] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.391] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89e48360, ftCreationTime.dwHighDateTime=0x1d4c7a6, ftLastAccessTime.dwLowDateTime=0xaeeeb920, ftLastAccessTime.dwHighDateTime=0x1d4d1ea, ftLastWriteTime.dwLowDateTime=0xaeeeb920, ftLastWriteTime.dwHighDateTime=0x1d4d1ea, nFileSizeHigh=0x0, nFileSizeLow=0xfee4, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="TQONL9Kgh.png", cAlternateFileName="TQONL9~1.PNG")) returned 1 [0057.391] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TQONL9Kgh.png") returned 42 [0057.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TQONL9Kgh.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tqonl9kgh.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.392] StrStrW (lpFirst="TQONL9Kgh.png", lpSrch=".wctc") returned 0x0 [0057.392] GetProcessHeap () returned 0x1130000 [0057.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.392] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TQONL9Kgh.png.wctc") returned 47 [0057.392] CloseHandle (hObject=0x3c0) returned 1 [0057.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TQONL9Kgh.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tqonl9kgh.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TQONL9Kgh.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\tqonl9kgh.png.wctc")) returned 1 [0057.392] GetProcessHeap () returned 0x1130000 [0057.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.392] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 393 [0057.392] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.392] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f617570, ftCreationTime.dwHighDateTime=0x1d4c621, ftLastAccessTime.dwLowDateTime=0xd64a7010, ftLastAccessTime.dwHighDateTime=0x1d4cd74, ftLastWriteTime.dwLowDateTime=0xd64a7010, ftLastWriteTime.dwHighDateTime=0x1d4cd74, nFileSizeHigh=0x0, nFileSizeLow=0x648a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="tUmlZBfa2K2ar4 sYMU.bmp", cAlternateFileName="TUMLZB~1.BMP")) returned 1 [0057.392] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\tUmlZBfa2K2ar4 sYMU.bmp") returned 52 [0057.392] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\tUmlZBfa2K2ar4 sYMU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tumlzbfa2k2ar4 symu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.392] StrStrW (lpFirst="tUmlZBfa2K2ar4 sYMU.bmp", lpSrch=".wctc") returned 0x0 [0057.393] GetProcessHeap () returned 0x1130000 [0057.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.393] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\tUmlZBfa2K2ar4 sYMU.bmp.wctc") returned 57 [0057.393] CloseHandle (hObject=0x3c0) returned 1 [0057.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\tUmlZBfa2K2ar4 sYMU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tumlzbfa2k2ar4 symu.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\tUmlZBfa2K2ar4 sYMU.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\tumlzbfa2k2ar4 symu.bmp.wctc")) returned 1 [0057.393] GetProcessHeap () returned 0x1130000 [0057.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.393] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 394 [0057.393] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.393] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b65680, ftCreationTime.dwHighDateTime=0x1d4d065, ftLastAccessTime.dwLowDateTime=0x8f09ed20, ftLastAccessTime.dwHighDateTime=0x1d4cb58, ftLastWriteTime.dwLowDateTime=0x8f09ed20, ftLastWriteTime.dwHighDateTime=0x1d4cb58, nFileSizeHigh=0x0, nFileSizeLow=0x13eda, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="TzPqQOlXuHrHf7ZYmW.bmp", cAlternateFileName="TZPQQO~1.BMP")) returned 1 [0057.393] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TzPqQOlXuHrHf7ZYmW.bmp") returned 51 [0057.393] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TzPqQOlXuHrHf7ZYmW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tzpqqolxuhrhf7zymw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.393] StrStrW (lpFirst="TzPqQOlXuHrHf7ZYmW.bmp", lpSrch=".wctc") returned 0x0 [0057.393] GetProcessHeap () returned 0x1130000 [0057.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.393] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TzPqQOlXuHrHf7ZYmW.bmp.wctc") returned 56 [0057.393] CloseHandle (hObject=0x3c0) returned 1 [0057.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TzPqQOlXuHrHf7ZYmW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tzpqqolxuhrhf7zymw.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\TzPqQOlXuHrHf7ZYmW.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\tzpqqolxuhrhf7zymw.bmp.wctc")) returned 1 [0057.394] GetProcessHeap () returned 0x1130000 [0057.394] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.394] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 395 [0057.394] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.394] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283e7ac0, ftCreationTime.dwHighDateTime=0x1d4c5db, ftLastAccessTime.dwLowDateTime=0xe099f340, ftLastAccessTime.dwHighDateTime=0x1d4ce9d, ftLastWriteTime.dwLowDateTime=0xe099f340, ftLastWriteTime.dwHighDateTime=0x1d4ce9d, nFileSizeHigh=0x0, nFileSizeLow=0x12e73, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="uswYG5X6MXxIpEP.jpg", cAlternateFileName="USWYG5~1.JPG")) returned 1 [0057.394] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\uswYG5X6MXxIpEP.jpg") returned 48 [0057.394] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\uswYG5X6MXxIpEP.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\uswyg5x6mxxipep.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.394] StrStrW (lpFirst="uswYG5X6MXxIpEP.jpg", lpSrch=".wctc") returned 0x0 [0057.394] GetProcessHeap () returned 0x1130000 [0057.394] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.394] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\uswYG5X6MXxIpEP.jpg.wctc") returned 53 [0057.394] CloseHandle (hObject=0x3c0) returned 1 [0057.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\uswYG5X6MXxIpEP.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\uswyg5x6mxxipep.jpg"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\uswYG5X6MXxIpEP.jpg.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\uswyg5x6mxxipep.jpg.wctc")) returned 1 [0057.395] GetProcessHeap () returned 0x1130000 [0057.395] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.395] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 396 [0057.395] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.395] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd8243a0, ftCreationTime.dwHighDateTime=0x1d4d3da, ftLastAccessTime.dwLowDateTime=0x60fb9480, ftLastAccessTime.dwHighDateTime=0x1d4d1f5, ftLastWriteTime.dwLowDateTime=0x60fb9480, ftLastWriteTime.dwHighDateTime=0x1d4d1f5, nFileSizeHigh=0x0, nFileSizeLow=0x3110, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="VTBopNC8w bQ.bmp", cAlternateFileName="VTBOPN~1.BMP")) returned 1 [0057.395] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\VTBopNC8w bQ.bmp") returned 45 [0057.395] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\VTBopNC8w bQ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vtbopnc8w bq.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.395] StrStrW (lpFirst="VTBopNC8w bQ.bmp", lpSrch=".wctc") returned 0x0 [0057.395] GetProcessHeap () returned 0x1130000 [0057.395] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.395] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\VTBopNC8w bQ.bmp.wctc") returned 50 [0057.395] CloseHandle (hObject=0x3c0) returned 1 [0057.395] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\VTBopNC8w bQ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\vtbopnc8w bq.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\VTBopNC8w bQ.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\vtbopnc8w bq.bmp.wctc")) returned 1 [0057.396] GetProcessHeap () returned 0x1130000 [0057.396] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.396] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 397 [0057.396] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.396] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee5af00, ftCreationTime.dwHighDateTime=0x1d4cd49, ftLastAccessTime.dwLowDateTime=0xbb8aa9c0, ftLastAccessTime.dwHighDateTime=0x1d4c851, ftLastWriteTime.dwLowDateTime=0xbb8aa9c0, ftLastWriteTime.dwHighDateTime=0x1d4c851, nFileSizeHigh=0x0, nFileSizeLow=0xf041, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="WBFekc02w8_7.gif", cAlternateFileName="WBFEKC~1.GIF")) returned 1 [0057.396] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WBFekc02w8_7.gif") returned 45 [0057.396] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WBFekc02w8_7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wbfekc02w8_7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.396] StrStrW (lpFirst="WBFekc02w8_7.gif", lpSrch=".wctc") returned 0x0 [0057.396] GetProcessHeap () returned 0x1130000 [0057.396] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.396] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WBFekc02w8_7.gif.wctc") returned 50 [0057.396] CloseHandle (hObject=0x3c0) returned 1 [0057.396] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WBFekc02w8_7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wbfekc02w8_7.gif"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WBFekc02w8_7.gif.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\wbfekc02w8_7.gif.wctc")) returned 1 [0057.397] GetProcessHeap () returned 0x1130000 [0057.397] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.397] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 398 [0057.397] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.397] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b2e7840, ftCreationTime.dwHighDateTime=0x1d4d180, ftLastAccessTime.dwLowDateTime=0x774f0420, ftLastAccessTime.dwHighDateTime=0x1d4c6be, ftLastWriteTime.dwLowDateTime=0x774f0420, ftLastWriteTime.dwHighDateTime=0x1d4c6be, nFileSizeHigh=0x0, nFileSizeLow=0x133ba, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="WPDn5EV5Y HkGzKtIT.bmp", cAlternateFileName="WPDN5E~1.BMP")) returned 1 [0057.397] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WPDn5EV5Y HkGzKtIT.bmp") returned 51 [0057.397] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WPDn5EV5Y HkGzKtIT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\wpdn5ev5y hkgzktit.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.397] StrStrW (lpFirst="WPDn5EV5Y HkGzKtIT.bmp", lpSrch=".wctc") returned 0x0 [0057.397] GetProcessHeap () returned 0x1130000 [0057.397] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.397] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WPDn5EV5Y HkGzKtIT.bmp.wctc") returned 56 [0057.397] CloseHandle (hObject=0x3c0) returned 1 [0057.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WPDn5EV5Y HkGzKtIT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\wpdn5ev5y hkgzktit.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\WPDn5EV5Y HkGzKtIT.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\wpdn5ev5y hkgzktit.bmp.wctc")) returned 1 [0057.397] GetProcessHeap () returned 0x1130000 [0057.397] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.397] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 399 [0057.398] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.398] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ebb330, ftCreationTime.dwHighDateTime=0x1d4cb16, ftLastAccessTime.dwLowDateTime=0xa9347280, ftLastAccessTime.dwHighDateTime=0x1d4d353, ftLastWriteTime.dwLowDateTime=0xa9347280, ftLastWriteTime.dwHighDateTime=0x1d4d353, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="yB_W-Os-vc.bmp", cAlternateFileName="YB_W-O~1.BMP")) returned 1 [0057.398] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yB_W-Os-vc.bmp") returned 43 [0057.398] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yB_W-Os-vc.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yb_w-os-vc.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.398] StrStrW (lpFirst="yB_W-Os-vc.bmp", lpSrch=".wctc") returned 0x0 [0057.398] GetProcessHeap () returned 0x1130000 [0057.398] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.398] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yB_W-Os-vc.bmp.wctc") returned 48 [0057.398] CloseHandle (hObject=0x3c0) returned 1 [0057.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yB_W-Os-vc.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yb_w-os-vc.bmp"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yB_W-Os-vc.bmp.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\yb_w-os-vc.bmp.wctc")) returned 1 [0057.398] GetProcessHeap () returned 0x1130000 [0057.398] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.398] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 400 [0057.398] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.398] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c33e8c0, ftCreationTime.dwHighDateTime=0x1d4cac7, ftLastAccessTime.dwLowDateTime=0x608c7680, ftLastAccessTime.dwHighDateTime=0x1d4cc38, ftLastWriteTime.dwLowDateTime=0x608c7680, ftLastWriteTime.dwHighDateTime=0x1d4cc38, nFileSizeHigh=0x0, nFileSizeLow=0x4f24, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="yYHB.jpg", cAlternateFileName="")) returned 1 [0057.398] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yYHB.jpg") returned 37 [0057.398] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yYHB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\yyhb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.399] StrStrW (lpFirst="yYHB.jpg", lpSrch=".wctc") returned 0x0 [0057.399] GetProcessHeap () returned 0x1130000 [0057.399] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.399] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yYHB.jpg.wctc") returned 42 [0057.399] CloseHandle (hObject=0x3c0) returned 1 [0057.399] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yYHB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\yyhb.jpg"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\yYHB.jpg.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\yyhb.jpg.wctc")) returned 1 [0057.399] GetProcessHeap () returned 0x1130000 [0057.399] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.399] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 401 [0057.399] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.399] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1e7bde0, ftCreationTime.dwHighDateTime=0x1d4d383, ftLastAccessTime.dwLowDateTime=0x8a00fd20, ftLastAccessTime.dwHighDateTime=0x1d4c9f8, ftLastWriteTime.dwLowDateTime=0x8a00fd20, ftLastWriteTime.dwHighDateTime=0x1d4c9f8, nFileSizeHigh=0x0, nFileSizeLow=0xff1c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="ZnAjTGE.png", cAlternateFileName="")) returned 1 [0057.399] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ZnAjTGE.png") returned 40 [0057.399] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ZnAjTGE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\znajtge.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.400] StrStrW (lpFirst="ZnAjTGE.png", lpSrch=".wctc") returned 0x0 [0057.400] GetProcessHeap () returned 0x1130000 [0057.400] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.400] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ZnAjTGE.png.wctc") returned 45 [0057.400] CloseHandle (hObject=0x3c0) returned 1 [0057.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ZnAjTGE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\znajtge.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\ZnAjTGE.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\znajtge.png.wctc")) returned 1 [0057.400] GetProcessHeap () returned 0x1130000 [0057.400] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.400] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 402 [0057.400] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.400] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56728290, ftCreationTime.dwHighDateTime=0x1d4cc1d, ftLastAccessTime.dwLowDateTime=0xc933fc80, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0xc933fc80, ftLastWriteTime.dwHighDateTime=0x1d4ceef, nFileSizeHigh=0x0, nFileSizeLow=0x89e3, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="zX1d.png", cAlternateFileName="")) returned 1 [0057.400] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\zX1d.png") returned 37 [0057.400] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\zX1d.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zx1d.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.400] StrStrW (lpFirst="zX1d.png", lpSrch=".wctc") returned 0x0 [0057.400] GetProcessHeap () returned 0x1130000 [0057.400] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.401] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\zX1d.png.wctc") returned 42 [0057.401] CloseHandle (hObject=0x3c0) returned 1 [0057.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\zX1d.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zx1d.png"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\zX1d.png.wctc" (normalized: "c:\\users\\fd1hvy\\pictures\\zx1d.png.wctc")) returned 1 [0057.401] GetProcessHeap () returned 0x1130000 [0057.401] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.401] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 403 [0057.401] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.401] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56728290, ftCreationTime.dwHighDateTime=0x1d4cc1d, ftLastAccessTime.dwLowDateTime=0xc933fc80, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0xc933fc80, ftLastWriteTime.dwHighDateTime=0x1d4ceef, nFileSizeHigh=0x0, nFileSizeLow=0x89e3, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="zx1d.png", cAlternateFileName="")) returned 0 [0057.401] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0057.401] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\read_me.txt") returned 40 [0057.401] GetProcessHeap () returned 0x1130000 [0057.401] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.403] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 149 [0057.403] GetProcessHeap () returned 0x1130000 [0057.403] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0057.403] GetProcessHeap () returned 0x1130000 [0057.403] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.404] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*") returned 45 [0057.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30e79b0, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0057.404] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\.") returned 45 [0057.404] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30e79b0, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.404] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\..") returned 46 [0057.404] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.404] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned 55 [0057.404] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.404] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.405] GetProcessHeap () returned 0x1130000 [0057.405] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.405] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 150 [0057.405] GetProcessHeap () returned 0x1130000 [0057.405] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3660088 | out: hHeap=0x1130000) returned 1 [0057.405] GetProcessHeap () returned 0x1130000 [0057.405] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.405] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\PrintHood\\*") returned 31 [0057.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30e79b0, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30e79b0, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30e79b0, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ")) returned 0xffffffff [0057.405] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\PrintHood\\read_me.txt") returned 41 [0057.405] GetProcessHeap () returned 0x1130000 [0057.405] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.405] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 151 [0057.405] GetProcessHeap () returned 0x1130000 [0057.405] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0057.407] GetProcessHeap () returned 0x1130000 [0057.408] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.408] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Recent\\*") returned 28 [0057.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30e79b0, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30e79b0, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30e79b0, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="read_me.txt", cAlternateFileName="Ά翾塚έ\x18")) returned 0xffffffff [0057.408] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Recent\\read_me.txt") returned 38 [0057.408] GetProcessHeap () returned 0x1130000 [0057.408] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.409] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 152 [0057.409] GetProcessHeap () returned 0x1130000 [0057.409] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f81220 | out: hHeap=0x1130000) returned 1 [0057.409] GetProcessHeap () returned 0x1130000 [0057.409] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f81220 [0057.409] wnsprintfW (in: pszDest=0x3f81220, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Saved Games\\*") returned 33 [0057.409] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30e79b0, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.409] wnsprintfW (in: pszDest=0x3f81220, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Saved Games\\.") returned 33 [0057.409] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30e79b0, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.409] wnsprintfW (in: pszDest=0x3f81220, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Saved Games\\..") returned 34 [0057.409] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.409] wnsprintfW (in: pszDest=0x3f81220, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned 43 [0057.409] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.409] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.409] GetProcessHeap () returned 0x1130000 [0057.409] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f81220 | out: hHeap=0x1130000) returned 1 [0057.409] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 153 [0057.409] GetProcessHeap () returned 0x1130000 [0057.409] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f91228 | out: hHeap=0x1130000) returned 1 [0057.410] GetProcessHeap () returned 0x1130000 [0057.410] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.411] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Searches\\*") returned 30 [0057.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30e79b0, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0057.411] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Searches\\.") returned 30 [0057.411] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30e79b0, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.411] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Searches\\..") returned 31 [0057.411] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.411] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned 40 [0057.411] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.411] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.414] GetProcessHeap () returned 0x1130000 [0057.414] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.415] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.wctc") returned 108 [0057.415] CloseHandle (hObject=0x3c0) returned 1 [0057.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.wctc" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.wctc")) returned 1 [0057.416] GetProcessHeap () returned 0x1130000 [0057.416] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.416] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 404 [0057.416] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.416] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0057.416] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0057.416] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Searches\\read_me.txt") returned 40 [0057.416] GetProcessHeap () returned 0x1130000 [0057.416] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.416] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 154 [0057.416] GetProcessHeap () returned 0x1130000 [0057.416] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fa1230 | out: hHeap=0x1130000) returned 1 [0057.502] GetProcessHeap () returned 0x1130000 [0057.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70008 [0057.508] wnsprintfW (in: pszDest=0x3f70008, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\*") returned 31 [0057.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\*", lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.508] wnsprintfW (in: pszDest=0x3f70008, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\.") returned 31 [0057.508] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf32b1300, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="..", cAlternateFileName="")) returned 1 [0057.508] wnsprintfW (in: pszDest=0x3f70008, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\..") returned 32 [0057.508] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3adf780 | out: lpFindFileData=0x3adf780*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x77c08fcf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.508] wnsprintfW (in: pszDest=0x3f70008, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\desktop.ini") returned 41 [0057.508] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0057.509] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.509] GetProcessHeap () returned 0x1130000 [0057.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70008 | out: hHeap=0x1130000) returned 1 [0057.509] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 167 [0057.509] GetProcessHeap () returned 0x1130000 [0057.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0057.766] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0057.766] ReadFile (in: hFile=0x3a8, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175ae0 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.766] GetProcessHeap () returned 0x1130000 [0057.766] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.767] GetProcessHeap () returned 0x1130000 [0057.767] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.767] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b08 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b08 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.768] GetProcessHeap () returned 0x1130000 [0057.768] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.769] GetProcessHeap () returned 0x1130000 [0057.769] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0057.770] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.770] WriteFile (in: hFile=0x3a8, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0057.770] CloseHandle (hObject=0x3a8) returned 0 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0057.770] GetProcessHeap () returned 0x1130000 [0057.770] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.770] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 142 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759c8 [0057.873] SystemFunction036 (in: RandomBuffer=0x11759c8, RandomBufferLength=0x20 | out: RandomBuffer=0x11759c8) returned 1 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0057.873] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b58 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175ab8 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0057.873] GetProcessHeap () returned 0x1130000 [0057.873] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.873] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.874] GetProcessHeap () returned 0x1130000 [0057.874] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.875] GetProcessHeap () returned 0x1130000 [0057.875] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0057.876] GetProcessHeap () returned 0x1130000 [0057.876] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0057.877] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.877] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0057.877] CloseHandle (hObject=0x3c0) returned 0 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0057.877] GetProcessHeap () returned 0x1130000 [0057.877] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.877] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 161 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0058.016] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.016] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175720 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.016] GetProcessHeap () returned 0x1130000 [0058.016] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.017] GetProcessHeap () returned 0x1130000 [0058.017] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.017] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779e8 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779e8 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.018] GetProcessHeap () returned 0x1130000 [0058.018] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.019] GetProcessHeap () returned 0x1130000 [0058.019] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.020] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.020] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0058.020] CloseHandle (hObject=0x3c0) returned 0 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.020] GetProcessHeap () returned 0x1130000 [0058.020] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.020] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 182 [0058.216] GetProcessHeap () returned 0x1130000 [0058.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.216] GetProcessHeap () returned 0x1130000 [0058.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0058.216] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0058.216] GetProcessHeap () returned 0x1130000 [0058.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.216] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0058.216] GetProcessHeap () returned 0x1130000 [0058.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.216] GetProcessHeap () returned 0x1130000 [0058.216] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.216] GetProcessHeap () returned 0x1130000 [0058.216] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11758b0 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175950 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.217] GetProcessHeap () returned 0x1130000 [0058.217] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.217] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de60 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de60 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.218] GetProcessHeap () returned 0x1130000 [0058.218] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.219] GetProcessHeap () returned 0x1130000 [0058.219] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0058.220] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.220] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0058.220] CloseHandle (hObject=0x3c0) returned 0 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.220] GetProcessHeap () returned 0x1130000 [0058.220] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.221] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 202 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0058.389] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.389] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11759c8 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175a90 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.389] GetProcessHeap () returned 0x1130000 [0058.389] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.390] GetProcessHeap () returned 0x1130000 [0058.390] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.390] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b08 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e010 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b08 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e010 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.391] GetProcessHeap () returned 0x1130000 [0058.391] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.391] GetProcessHeap () returned 0x1130000 [0058.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.392] GetProcessHeap () returned 0x1130000 [0058.392] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0058.393] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.393] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0058.393] CloseHandle (hObject=0x3c0) returned 0 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0058.393] GetProcessHeap () returned 0x1130000 [0058.393] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.393] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 227 [0058.560] GetProcessHeap () returned 0x1130000 [0058.560] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.560] GetProcessHeap () returned 0x1130000 [0058.560] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0058.560] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0058.560] GetProcessHeap () returned 0x1130000 [0058.560] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.560] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0058.560] GetProcessHeap () returned 0x1130000 [0058.560] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.560] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175ab8 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175ae0 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.561] GetProcessHeap () returned 0x1130000 [0058.561] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.561] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779b8 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779b8 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.562] GetProcessHeap () returned 0x1130000 [0058.562] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0058.562] GetProcessHeap () returned 0x1130000 [0058.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.563] GetProcessHeap () returned 0x1130000 [0058.563] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.563] GetProcessHeap () returned 0x1130000 [0058.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.564] GetProcessHeap () returned 0x1130000 [0058.564] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0058.564] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.564] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0058.564] CloseHandle (hObject=0x3c0) returned 0 [0058.565] GetProcessHeap () returned 0x1130000 [0058.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.565] GetProcessHeap () returned 0x1130000 [0058.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.565] GetProcessHeap () returned 0x1130000 [0058.565] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.565] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 286 [0058.654] GetProcessHeap () returned 0x1130000 [0058.654] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.654] GetProcessHeap () returned 0x1130000 [0058.654] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11759a0 [0058.654] SystemFunction036 (in: RandomBuffer=0x11759a0, RandomBufferLength=0x20 | out: RandomBuffer=0x11759a0) returned 1 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.655] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x11756f8 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.655] GetProcessHeap () returned 0x1130000 [0058.655] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b08 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b08 | out: hHeap=0x1130000) returned 1 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ff0 [0058.656] GetProcessHeap () returned 0x1130000 [0058.656] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ff0 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.657] GetProcessHeap () returned 0x1130000 [0058.657] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.658] GetProcessHeap () returned 0x1130000 [0058.658] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.658] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.658] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0058.659] CloseHandle (hObject=0x3c0) returned 0 [0058.659] GetProcessHeap () returned 0x1130000 [0058.659] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.659] GetProcessHeap () returned 0x1130000 [0058.659] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0058.659] GetProcessHeap () returned 0x1130000 [0058.659] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.659] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 352 [0058.850] GetProcessHeap () returned 0x1130000 [0058.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0058.850] GetProcessHeap () returned 0x1130000 [0058.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0058.850] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0058.850] GetProcessHeap () returned 0x1130000 [0058.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.850] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3adf94c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3adf94c*=0x0, lpOverlapped=0x0) returned 0 [0058.850] GetProcessHeap () returned 0x1130000 [0058.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11759c8 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.851] GetProcessHeap () returned 0x1130000 [0058.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177aa8 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177aa8 | out: hHeap=0x1130000) returned 1 [0058.852] GetProcessHeap () returned 0x1130000 [0058.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0058.852] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.853] GetProcessHeap () returned 0x1130000 [0058.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0058.854] GetProcessHeap () returned 0x1130000 [0058.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.855] GetProcessHeap () returned 0x1130000 [0058.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759c8 | out: hHeap=0x1130000) returned 1 [0058.855] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.855] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3adf968, lpOverlapped=0x0) returned 0 [0058.855] CloseHandle (hObject=0x3c0) returned 0 [0058.855] GetProcessHeap () returned 0x1130000 [0058.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.855] GetProcessHeap () returned 0x1130000 [0058.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0058.855] GetProcessHeap () returned 0x1130000 [0058.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0058.855] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 415 Thread: id = 7 os_tid = 0x504 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0054.456] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0054.456] ReadFile (in: hFile=0x3bc, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175b58 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c98, Size=0x20) returned 0x1175950 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.456] GetProcessHeap () returned 0x1130000 [0054.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0054.457] GetProcessHeap () returned 0x1130000 [0054.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0054.457] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.458] GetProcessHeap () returned 0x1130000 [0054.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.458] GetProcessHeap () returned 0x1130000 [0054.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11bdc28 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11bdc28 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0054.459] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0054.460] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0054.460] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0054.460] CloseHandle (hObject=0x3bc) returned 0 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0054.460] GetProcessHeap () returned 0x1130000 [0054.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0054.460] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 38 [0054.818] GetProcessHeap () returned 0x1130000 [0054.818] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11cdc30 [0054.819] wnsprintfW (in: pszDest=0x11cdc30, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\*") returned 19 [0054.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a60 [0054.819] wnsprintfW (in: pszDest=0x11cdc30, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\.") returned 19 [0054.819] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0054.819] wnsprintfW (in: pszDest=0x11cdc30, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\..") returned 20 [0054.819] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0054.819] wnsprintfW (in: pszDest=0x11cdc30, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 33 [0054.819] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.819] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18a85c4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18a85c4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0054.819] wnsprintfW (in: pszDest=0x11cdc30, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\read_me.txt") returned 29 [0054.819] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\read_me.txt" (normalized: "c:\\boot\\bg-bg\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0054.819] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0054.819] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0054.819] CloseHandle (hObject=0x3b8) returned 1 [0054.820] FindNextFileW (in: hFindFile=0x1170a60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18a85c4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18a85c4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18a85c4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0054.820] FindClose (in: hFindFile=0x1170a60 | out: hFindFile=0x1170a60) returned 1 [0055.026] wnsprintfW (in: pszDest=0x11cdc30, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\bg-BG\\read_me.txt") returned 29 [0055.026] GetProcessHeap () returned 0x1130000 [0055.027] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11cdc30 | out: hHeap=0x1130000) returned 1 [0055.027] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 33 [0055.027] GetProcessHeap () returned 0x1130000 [0055.027] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0055.162] GetProcessHeap () returned 0x1130000 [0055.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0055.163] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\*") returned 19 [0055.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf18ce7ff, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0055.163] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\.") returned 19 [0055.163] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf18ce7ff, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.164] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\..") returned 20 [0055.164] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.164] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 33 [0055.164] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.164] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0055.164] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui") returned 33 [0055.164] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.164] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18ce7ff, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18ce7ff, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18ce7ff, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.164] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\read_me.txt") returned 29 [0055.164] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\read_me.txt" (normalized: "c:\\boot\\de-de\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0055.164] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.164] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.164] CloseHandle (hObject=0x3c0) returned 1 [0055.164] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18ce7ff, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf18ce7ff, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf18ce7ff, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.164] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 1 [0055.177] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\read_me.txt") returned 29 [0055.178] GetProcessHeap () returned 0x1130000 [0055.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0055.188] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 37 [0055.188] GetProcessHeap () returned 0x1130000 [0055.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0055.190] GetProcessHeap () returned 0x1130000 [0055.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3840078 [0055.192] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\*") returned 19 [0055.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf1b30d89, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170a20 [0055.206] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\.") returned 19 [0055.210] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf1b30d89, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.210] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\..") returned 20 [0055.210] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.210] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 33 [0055.210] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.306] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0055.306] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui") returned 33 [0055.306] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.306] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b30d89, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b30d89, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b30d89, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.306] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\read_me.txt") returned 29 [0055.306] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\read_me.txt" (normalized: "c:\\boot\\el-gr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0055.307] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.307] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.307] CloseHandle (hObject=0x3b4) returned 1 [0055.307] FindNextFileW (in: hFindFile=0x1170a20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b30d89, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b30d89, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b30d89, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.307] FindClose (in: hFindFile=0x1170a20 | out: hFindFile=0x1170a20) returned 0 [0055.307] wnsprintfW (in: pszDest=0x3840078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\read_me.txt") returned 29 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3840078 | out: hHeap=0x1130000) returned 1 [0055.307] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 38 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3860088 | out: hHeap=0x1130000) returned 1 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0055.307] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0055.307] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175b08 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0055.307] GetProcessHeap () returned 0x1130000 [0055.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.308] GetProcessHeap () returned 0x1130000 [0055.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.308] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.309] GetProcessHeap () returned 0x1130000 [0055.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.310] GetProcessHeap () returned 0x1130000 [0055.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.311] GetProcessHeap () returned 0x1130000 [0055.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.311] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.388] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.398] CloseHandle (hObject=0x3c0) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0055.460] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 53 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.460] GetProcessHeap () returned 0x1130000 [0055.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0055.461] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0055.461] ReadFile (in: hFile=0x3c0, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175860 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.461] GetProcessHeap () returned 0x1130000 [0055.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.461] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0055.462] GetProcessHeap () returned 0x1130000 [0055.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0055.462] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.463] GetProcessHeap () returned 0x1130000 [0055.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.464] GetProcessHeap () returned 0x1130000 [0055.464] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.464] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.464] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.465] CloseHandle (hObject=0x3c0) returned 0 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.465] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 54 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0055.465] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3698108 [0055.465] ReadFile (in: hFile=0x3c0, lpBuffer=0x3698108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3698108, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x11756d0 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175b30 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.465] GetProcessHeap () returned 0x1130000 [0055.465] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.465] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.466] GetProcessHeap () returned 0x1130000 [0055.466] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.466] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.467] GetProcessHeap () returned 0x1130000 [0055.467] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.467] GetProcessHeap () returned 0x1130000 [0055.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.468] GetProcessHeap () returned 0x1130000 [0055.468] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0055.469] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.469] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.469] CloseHandle (hObject=0x3c0) returned 0 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3698108 | out: hHeap=0x1130000) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0055.469] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 55 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756d0 [0055.469] SystemFunction036 (in: RandomBuffer=0x11756d0, RandomBufferLength=0x20 | out: RandomBuffer=0x11756d0) returned 1 [0055.469] GetProcessHeap () returned 0x1130000 [0055.469] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0055.469] ReadFile (in: hFile=0x3c0, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.469] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175b30 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175888 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.470] GetProcessHeap () returned 0x1130000 [0055.470] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177ad8 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177ad8 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.471] GetProcessHeap () returned 0x1130000 [0055.471] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.472] GetProcessHeap () returned 0x1130000 [0055.472] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.472] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.473] GetProcessHeap () returned 0x1130000 [0055.473] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0055.473] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.473] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.473] CloseHandle (hObject=0x3c0) returned 0 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0055.474] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 56 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0055.474] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0055.474] ReadFile (in: hFile=0x3c0, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x11756d0 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.474] GetProcessHeap () returned 0x1130000 [0055.474] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.474] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.475] GetProcessHeap () returned 0x1130000 [0055.475] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.475] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.476] GetProcessHeap () returned 0x1130000 [0055.476] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.477] GetProcessHeap () returned 0x1130000 [0055.477] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0055.478] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.478] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.478] CloseHandle (hObject=0x3c0) returned 0 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.478] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 57 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0055.478] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3698108 [0055.478] ReadFile (in: hFile=0x3c0, lpBuffer=0x3698108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3698108, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175b58 [0055.478] GetProcessHeap () returned 0x1130000 [0055.478] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.478] GetProcessHeap () returned 0x1130000 [0055.479] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175a68 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.479] GetProcessHeap () returned 0x1130000 [0055.479] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177898 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177898 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.480] GetProcessHeap () returned 0x1130000 [0055.480] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0055.480] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.481] GetProcessHeap () returned 0x1130000 [0055.481] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.481] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0055.482] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.482] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.482] CloseHandle (hObject=0x3c0) returned 0 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3698108 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0055.482] GetProcessHeap () returned 0x1130000 [0055.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.482] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 58 [0055.482] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0055.483] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0055.483] ReadFile (in: hFile=0x3c0, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b08 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c98, Size=0x20) returned 0x1175798 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.483] GetProcessHeap () returned 0x1130000 [0055.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.483] GetProcessHeap () returned 0x1130000 [0055.573] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.573] GetProcessHeap () returned 0x1130000 [0055.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.573] GetProcessHeap () returned 0x1130000 [0055.573] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.573] GetProcessHeap () returned 0x1130000 [0055.573] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.573] GetProcessHeap () returned 0x1130000 [0055.573] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.573] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.574] GetProcessHeap () returned 0x1130000 [0055.574] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177988 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177988 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.575] GetProcessHeap () returned 0x1130000 [0055.575] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.576] GetProcessHeap () returned 0x1130000 [0055.576] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.577] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.577] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.577] CloseHandle (hObject=0x3c0) returned 0 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.577] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 60 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.577] GetProcessHeap () returned 0x1130000 [0055.577] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0055.577] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0055.577] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0055.578] ReadFile (in: hFile=0x3c0, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175860 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x1175a40 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.578] GetProcessHeap () returned 0x1130000 [0055.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.579] GetProcessHeap () returned 0x1130000 [0055.579] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.579] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.580] GetProcessHeap () returned 0x1130000 [0055.580] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0055.581] GetProcessHeap () returned 0x1130000 [0055.581] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.582] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.582] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.582] CloseHandle (hObject=0x3c0) returned 0 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.582] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 61 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0055.582] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.582] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a40 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.582] GetProcessHeap () returned 0x1130000 [0055.582] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.583] GetProcessHeap () returned 0x1130000 [0055.583] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.583] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.584] GetProcessHeap () returned 0x1130000 [0055.584] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.585] GetProcessHeap () returned 0x1130000 [0055.585] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0055.586] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.586] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.586] CloseHandle (hObject=0x3c0) returned 0 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0055.586] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 62 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a68 [0055.586] SystemFunction036 (in: RandomBuffer=0x1175a68, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a68) returned 1 [0055.586] GetProcessHeap () returned 0x1130000 [0055.586] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.586] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.586] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a40 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175978 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.587] GetProcessHeap () returned 0x1130000 [0055.587] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.588] GetProcessHeap () returned 0x1130000 [0055.588] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.589] GetProcessHeap () returned 0x1130000 [0055.589] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.590] GetProcessHeap () returned 0x1130000 [0055.590] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0055.590] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.590] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.591] CloseHandle (hObject=0x3c0) returned 0 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.591] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 63 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758d8 [0055.591] SystemFunction036 (in: RandomBuffer=0x11758d8, RandomBufferLength=0x20 | out: RandomBuffer=0x11758d8) returned 1 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0055.591] ReadFile (in: hFile=0x3c0, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bd8, Size=0x20) returned 0x1175888 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.591] GetProcessHeap () returned 0x1130000 [0055.591] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.591] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.592] GetProcessHeap () returned 0x1130000 [0055.592] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.592] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e328 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e328 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.593] GetProcessHeap () returned 0x1130000 [0055.593] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.594] GetProcessHeap () returned 0x1130000 [0055.594] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.595] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.595] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.595] CloseHandle (hObject=0x3c0) returned 0 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.595] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 64 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0055.595] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.595] ReadFile (in: hFile=0x3bc, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.595] GetProcessHeap () returned 0x1130000 [0055.595] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0055.595] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x11758d8 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175900 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.596] GetProcessHeap () returned 0x1130000 [0055.596] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.597] GetProcessHeap () returned 0x1130000 [0055.597] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.597] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.598] GetProcessHeap () returned 0x1130000 [0055.598] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0055.599] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.599] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.599] CloseHandle (hObject=0x3bc) returned 0 [0055.599] GetProcessHeap () returned 0x1130000 [0055.599] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.599] GetProcessHeap () returned 0x1130000 [0055.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.600] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 65 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0055.600] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0055.600] ReadFile (in: hFile=0x3bc, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150be8, Size=0x20) returned 0x1175a18 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11758d8 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.600] GetProcessHeap () returned 0x1130000 [0055.600] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.600] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.601] GetProcessHeap () returned 0x1130000 [0055.601] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.602] GetProcessHeap () returned 0x1130000 [0055.602] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.602] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.603] GetProcessHeap () returned 0x1130000 [0055.603] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.603] GetProcessHeap () returned 0x1130000 [0055.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0055.604] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.604] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.604] CloseHandle (hObject=0x3bc) returned 0 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.604] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 66 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0055.604] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36940e8 [0055.604] ReadFile (in: hFile=0x3bc, lpBuffer=0x36940e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36940e8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175860 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175798 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.604] GetProcessHeap () returned 0x1130000 [0055.604] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.604] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.605] GetProcessHeap () returned 0x1130000 [0055.605] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.605] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.606] GetProcessHeap () returned 0x1130000 [0055.606] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.606] GetProcessHeap () returned 0x1130000 [0055.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.607] GetProcessHeap () returned 0x1130000 [0055.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.608] GetProcessHeap () returned 0x1130000 [0055.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.608] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.608] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.608] CloseHandle (hObject=0x3bc) returned 0 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36940e8 | out: hHeap=0x1130000) returned 1 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.707] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 68 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0055.707] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.707] ReadFile (in: hFile=0x3bc, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11756f8 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.707] GetProcessHeap () returned 0x1130000 [0055.707] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.708] GetProcessHeap () returned 0x1130000 [0055.708] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.709] GetProcessHeap () returned 0x1130000 [0055.709] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.710] GetProcessHeap () returned 0x1130000 [0055.710] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.711] GetProcessHeap () returned 0x1130000 [0055.711] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0055.712] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.712] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.712] CloseHandle (hObject=0x3bc) returned 0 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.712] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 69 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0055.712] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0055.712] GetProcessHeap () returned 0x1130000 [0055.712] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36930e0 [0055.712] ReadFile (in: hFile=0x3c0, lpBuffer=0x36930e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36930e0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bf8, Size=0x20) returned 0x1175b08 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x11758b0 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.713] GetProcessHeap () returned 0x1130000 [0055.713] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.713] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.714] GetProcessHeap () returned 0x1130000 [0055.714] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.714] GetProcessHeap () returned 0x1130000 [0055.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177aa8 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177aa8 | out: hHeap=0x1130000) returned 1 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0055.715] GetProcessHeap () returned 0x1130000 [0055.715] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.716] GetProcessHeap () returned 0x1130000 [0055.716] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.716] GetProcessHeap () returned 0x1130000 [0055.717] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.717] GetProcessHeap () returned 0x1130000 [0055.717] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.717] GetProcessHeap () returned 0x1130000 [0055.719] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.719] GetProcessHeap () returned 0x1130000 [0055.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.719] GetProcessHeap () returned 0x1130000 [0055.719] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.719] GetProcessHeap () returned 0x1130000 [0055.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.719] GetProcessHeap () returned 0x1130000 [0055.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.719] GetProcessHeap () returned 0x1130000 [0055.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0055.719] GetProcessHeap () returned 0x1130000 [0055.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.719] GetProcessHeap () returned 0x1130000 [0055.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.719] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.719] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.719] CloseHandle (hObject=0x3c0) returned 0 [0055.719] GetProcessHeap () returned 0x1130000 [0055.719] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36930e0 | out: hHeap=0x1130000) returned 1 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.720] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 70 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0055.720] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.720] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175ba8 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x11756d0 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.720] GetProcessHeap () returned 0x1130000 [0055.720] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.721] GetProcessHeap () returned 0x1130000 [0055.721] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0055.722] GetProcessHeap () returned 0x1130000 [0055.722] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.723] GetProcessHeap () returned 0x1130000 [0055.723] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.724] GetProcessHeap () returned 0x1130000 [0055.724] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.724] GetProcessHeap () returned 0x1130000 [0055.725] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0055.725] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.725] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.725] CloseHandle (hObject=0x3c0) returned 0 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0055.725] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 71 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0055.725] GetProcessHeap () returned 0x1130000 [0055.725] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0055.725] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.726] ReadFile (in: hFile=0x3b4, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150af8, Size=0x20) returned 0x1175860 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175888 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.726] GetProcessHeap () returned 0x1130000 [0055.726] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.726] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.727] GetProcessHeap () returned 0x1130000 [0055.727] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b38 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b38 | out: hHeap=0x1130000) returned 1 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.728] GetProcessHeap () returned 0x1130000 [0055.728] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.729] GetProcessHeap () returned 0x1130000 [0055.729] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.730] GetProcessHeap () returned 0x1130000 [0055.730] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.731] GetProcessHeap () returned 0x1130000 [0055.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.731] GetProcessHeap () returned 0x1130000 [0055.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.731] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.731] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.731] CloseHandle (hObject=0x3b4) returned 0 [0055.731] GetProcessHeap () returned 0x1130000 [0055.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.731] GetProcessHeap () returned 0x1130000 [0055.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0055.731] GetProcessHeap () returned 0x1130000 [0055.731] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0055.732] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 72 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0055.732] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.732] ReadFile (in: hFile=0x3b4, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175888 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175a68 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.732] GetProcessHeap () returned 0x1130000 [0055.732] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.733] GetProcessHeap () returned 0x1130000 [0055.733] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.734] GetProcessHeap () returned 0x1130000 [0055.734] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.734] GetProcessHeap () returned 0x1130000 [0055.734] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.734] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.735] GetProcessHeap () returned 0x1130000 [0055.735] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.735] GetProcessHeap () returned 0x1130000 [0055.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.736] GetProcessHeap () returned 0x1130000 [0055.736] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.737] GetProcessHeap () returned 0x1130000 [0055.737] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.737] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.737] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153bc0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.737] CloseHandle (hObject=0x3b4) returned 0 [0055.737] GetProcessHeap () returned 0x1130000 [0055.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0055.738] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 73 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0055.738] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36930e0 [0055.738] ReadFile (in: hFile=0x3b4, lpBuffer=0x36930e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36930e0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c98, Size=0x20) returned 0x1175888 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175a18 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.738] GetProcessHeap () returned 0x1130000 [0055.738] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.739] GetProcessHeap () returned 0x1130000 [0055.739] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.739] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177898 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177898 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.740] GetProcessHeap () returned 0x1130000 [0055.740] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.741] GetProcessHeap () returned 0x1130000 [0055.741] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.742] GetProcessHeap () returned 0x1130000 [0055.742] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.742] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.742] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.742] CloseHandle (hObject=0x3b4) returned 0 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36930e0 | out: hHeap=0x1130000) returned 1 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.743] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 74 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0055.743] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.743] ReadFile (in: hFile=0x3b4, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175888 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175a18 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.743] GetProcessHeap () returned 0x1130000 [0055.743] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.744] GetProcessHeap () returned 0x1130000 [0055.744] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177838 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177838 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0055.745] GetProcessHeap () returned 0x1130000 [0055.745] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.745] GetProcessHeap () returned 0x1130000 [0055.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.746] GetProcessHeap () returned 0x1130000 [0055.746] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.747] GetProcessHeap () returned 0x1130000 [0055.747] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.747] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.747] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.748] CloseHandle (hObject=0x3b4) returned 0 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.748] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 75 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0055.748] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0055.748] ReadFile (in: hFile=0x3b4, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175888 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.748] GetProcessHeap () returned 0x1130000 [0055.748] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.748] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.749] GetProcessHeap () returned 0x1130000 [0055.749] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.749] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.750] GetProcessHeap () returned 0x1130000 [0055.750] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.751] GetProcessHeap () returned 0x1130000 [0055.751] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.752] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.752] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.752] CloseHandle (hObject=0x3b4) returned 0 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0055.752] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 76 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0055.752] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36930e0 [0055.752] ReadFile (in: hFile=0x3b4, lpBuffer=0x36930e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36930e0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.752] GetProcessHeap () returned 0x1130000 [0055.752] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175ba8 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175a68 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.753] GetProcessHeap () returned 0x1130000 [0055.753] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e328 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0055.754] GetProcessHeap () returned 0x1130000 [0055.754] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e328 | out: hHeap=0x1130000) returned 1 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.755] GetProcessHeap () returned 0x1130000 [0055.755] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0055.756] GetProcessHeap () returned 0x1130000 [0055.756] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0055.757] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.757] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.757] CloseHandle (hObject=0x3b4) returned 0 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36930e0 | out: hHeap=0x1130000) returned 1 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0055.757] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 77 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ab8 [0055.757] SystemFunction036 (in: RandomBuffer=0x1175ab8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ab8) returned 1 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36930e0 [0055.757] ReadFile (in: hFile=0x3b4, lpBuffer=0x36930e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36930e0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175ba8 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x11756d0 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.757] GetProcessHeap () returned 0x1130000 [0055.757] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.758] GetProcessHeap () returned 0x1130000 [0055.758] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.759] GetProcessHeap () returned 0x1130000 [0055.759] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.759] GetProcessHeap () returned 0x1130000 [0055.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.760] GetProcessHeap () returned 0x1130000 [0055.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.760] GetProcessHeap () returned 0x1130000 [0055.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.760] GetProcessHeap () returned 0x1130000 [0055.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.760] GetProcessHeap () returned 0x1130000 [0055.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.760] GetProcessHeap () returned 0x1130000 [0055.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.760] GetProcessHeap () returned 0x1130000 [0055.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.760] GetProcessHeap () returned 0x1130000 [0055.760] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.760] GetProcessHeap () returned 0x1130000 [0055.760] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.760] GetProcessHeap () returned 0x1130000 [0055.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.829] GetProcessHeap () returned 0x1130000 [0055.829] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0055.830] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.830] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.830] CloseHandle (hObject=0x3b4) returned 0 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36930e0 | out: hHeap=0x1130000) returned 1 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.830] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 79 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175978 [0055.830] SystemFunction036 (in: RandomBuffer=0x1175978, RandomBufferLength=0x20 | out: RandomBuffer=0x1175978) returned 1 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0055.830] ReadFile (in: hFile=0x3b4, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x11756f8 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175a68 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.830] GetProcessHeap () returned 0x1130000 [0055.830] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.831] GetProcessHeap () returned 0x1130000 [0055.831] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.831] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779e8 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779e8 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.832] GetProcessHeap () returned 0x1130000 [0055.832] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.833] GetProcessHeap () returned 0x1130000 [0055.833] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.833] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0055.834] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.834] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.834] CloseHandle (hObject=0x3b4) returned 0 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175978 | out: hHeap=0x1130000) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.834] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 80 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.834] GetProcessHeap () returned 0x1130000 [0055.834] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0055.834] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0055.834] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.835] ReadFile (in: hFile=0x3b4, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175ae0 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175950 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.835] GetProcessHeap () returned 0x1130000 [0055.835] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.835] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.836] GetProcessHeap () returned 0x1130000 [0055.836] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0055.836] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.837] GetProcessHeap () returned 0x1130000 [0055.837] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.837] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.838] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0055.838] GetProcessHeap () returned 0x1130000 [0055.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0055.839] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.839] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.839] CloseHandle (hObject=0x3b4) returned 0 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.839] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 81 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0055.839] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0055.839] ReadFile (in: hFile=0x3b4, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175b08 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175900 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0055.839] GetProcessHeap () returned 0x1130000 [0055.839] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.839] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.840] GetProcessHeap () returned 0x1130000 [0055.840] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.841] GetProcessHeap () returned 0x1130000 [0055.841] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.842] GetProcessHeap () returned 0x1130000 [0055.842] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.842] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.843] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.843] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153590, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.843] CloseHandle (hObject=0x3b4) returned 0 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.843] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 82 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0055.843] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0055.843] GetProcessHeap () returned 0x1130000 [0055.843] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.844] ReadFile (in: hFile=0x3b4, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175b08 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175a40 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0055.844] GetProcessHeap () returned 0x1130000 [0055.844] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779e8 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779e8 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0055.845] GetProcessHeap () returned 0x1130000 [0055.845] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0055.845] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.846] GetProcessHeap () returned 0x1130000 [0055.846] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.847] GetProcessHeap () returned 0x1130000 [0055.847] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.847] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.847] WriteFile (in: hFile=0x3b4, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.848] CloseHandle (hObject=0x3b4) returned 0 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0055.848] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 83 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0055.848] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.848] ReadFile (in: hFile=0x3b4, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175a40 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.848] GetProcessHeap () returned 0x1130000 [0055.848] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.848] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.849] GetProcessHeap () returned 0x1130000 [0055.849] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.849] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e520 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e520 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.850] GetProcessHeap () returned 0x1130000 [0055.850] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.851] GetProcessHeap () returned 0x1130000 [0055.851] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0055.852] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.852] WriteFile (in: hFile=0x3b4, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.852] CloseHandle (hObject=0x3b4) returned 0 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0055.852] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 84 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0055.852] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0055.852] GetProcessHeap () returned 0x1130000 [0055.852] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0055.853] ReadFile (in: hFile=0x3b4, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175b58 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175860 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.853] GetProcessHeap () returned 0x1130000 [0055.853] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.853] GetProcessHeap () returned 0x1130000 [0055.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0055.854] GetProcessHeap () returned 0x1130000 [0055.854] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x11ddc38 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.855] GetProcessHeap () returned 0x1130000 [0055.855] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.855] GetProcessHeap () returned 0x1130000 [0055.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.856] GetProcessHeap () returned 0x1130000 [0055.856] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.856] GetProcessHeap () returned 0x1130000 [0055.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0055.857] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.857] WriteFile (in: hFile=0x3b4, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.857] CloseHandle (hObject=0x3b4) returned 0 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0055.857] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 85 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0055.857] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36950f0 [0055.857] ReadFile (in: hFile=0x3b4, lpBuffer=0x36950f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36950f0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0055.857] GetProcessHeap () returned 0x1130000 [0055.857] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175b30 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175798 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0055.858] GetProcessHeap () returned 0x1130000 [0055.858] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0055.859] GetProcessHeap () returned 0x1130000 [0055.859] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0055.859] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.860] GetProcessHeap () returned 0x1130000 [0055.860] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121e6a0 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121e6a0 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121e6a0 | out: hHeap=0x1130000) returned 1 [0055.861] GetProcessHeap () returned 0x1130000 [0055.861] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0055.861] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0055.861] WriteFile (in: hFile=0x3b4, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0055.861] CloseHandle (hObject=0x3b4) returned 0 [0055.861] GetProcessHeap () returned 0x1130000 [0055.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36950f0 | out: hHeap=0x1130000) returned 1 [0055.862] GetProcessHeap () returned 0x1130000 [0055.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0055.862] GetProcessHeap () returned 0x1130000 [0055.862] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0055.862] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 86 [0055.862] GetProcessHeap () returned 0x1130000 [0055.862] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f70210 [0055.862] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\*") returned 19 [0055.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.862] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\.") returned 19 [0055.862] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.862] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\..") returned 20 [0055.862] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.862] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 33 [0055.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.862] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b57067, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b57067, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.862] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\read_me.txt") returned 29 [0055.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\read_me.txt" (normalized: "c:\\boot\\en-gb\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0055.862] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.862] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.862] CloseHandle (hObject=0x3bc) returned 1 [0055.863] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b57067, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b57067, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.863] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0055.863] wnsprintfW (in: pszDest=0x3f70210, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\en-GB\\read_me.txt") returned 29 [0055.863] GetProcessHeap () returned 0x1130000 [0055.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f70210 | out: hHeap=0x1130000) returned 1 [0055.863] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 39 [0055.863] GetProcessHeap () returned 0x1130000 [0055.863] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0055.863] GetProcessHeap () returned 0x1130000 [0055.863] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0055.863] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\*") returned 19 [0055.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.863] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\.") returned 19 [0055.863] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.863] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\..") returned 20 [0055.863] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.863] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui") returned 33 [0055.863] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.863] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0055.863] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui") returned 33 [0055.863] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.863] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b57067, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b57067, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.863] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\read_me.txt") returned 29 [0055.863] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\read_me.txt" (normalized: "c:\\boot\\en-us\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0055.864] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.864] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.864] CloseHandle (hObject=0x3bc) returned 1 [0055.864] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b57067, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b57067, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.864] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0055.864] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\read_me.txt") returned 29 [0055.864] GetProcessHeap () returned 0x1130000 [0055.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0055.864] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 40 [0055.864] GetProcessHeap () returned 0x1130000 [0055.864] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3870090 | out: hHeap=0x1130000) returned 1 [0055.864] GetProcessHeap () returned 0x1130000 [0055.864] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3870090 [0055.864] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\*") returned 19 [0055.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.864] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\.") returned 19 [0055.864] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.864] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\..") returned 20 [0055.864] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.864] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 33 [0055.864] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.864] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0055.865] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui") returned 33 [0055.865] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.865] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b57067, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b57067, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.865] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\read_me.txt") returned 29 [0055.865] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\read_me.txt" (normalized: "c:\\boot\\es-es\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0055.865] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.865] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.865] CloseHandle (hObject=0x3bc) returned 1 [0055.865] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b57067, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b57067, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.865] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0055.865] wnsprintfW (in: pszDest=0x3870090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\read_me.txt") returned 29 [0055.865] GetProcessHeap () returned 0x1130000 [0055.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3870090 | out: hHeap=0x1130000) returned 1 [0055.865] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 41 [0055.865] GetProcessHeap () returned 0x1130000 [0055.865] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3880098 | out: hHeap=0x1130000) returned 1 [0055.865] GetProcessHeap () returned 0x1130000 [0055.865] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0055.865] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\*") returned 19 [0055.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.865] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\.") returned 19 [0055.865] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.865] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\..") returned 20 [0055.866] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.866] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 33 [0055.866] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.866] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b57067, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b57067, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.866] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\read_me.txt") returned 29 [0055.866] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\read_me.txt" (normalized: "c:\\boot\\es-mx\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0055.866] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.866] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.866] CloseHandle (hObject=0x3bc) returned 1 [0055.866] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b57067, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b57067, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b57067, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.866] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0055.866] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\es-MX\\read_me.txt") returned 29 [0055.866] GetProcessHeap () returned 0x1130000 [0055.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0055.866] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 42 [0055.866] GetProcessHeap () returned 0x1130000 [0055.866] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0055.866] GetProcessHeap () returned 0x1130000 [0055.866] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3640078 [0055.866] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\*") returned 19 [0055.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.866] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\.") returned 19 [0055.866] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.867] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\..") returned 20 [0055.867] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.867] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 33 [0055.867] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.867] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b7d24a, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b7d24a, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.867] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\read_me.txt") returned 29 [0055.867] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\read_me.txt" (normalized: "c:\\boot\\et-ee\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0055.867] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.867] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.867] CloseHandle (hObject=0x3bc) returned 1 [0055.867] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b7d24a, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b7d24a, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.867] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0055.867] wnsprintfW (in: pszDest=0x3640078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\et-EE\\read_me.txt") returned 29 [0055.867] GetProcessHeap () returned 0x1130000 [0055.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3640078 | out: hHeap=0x1130000) returned 1 [0055.867] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 43 [0055.867] GetProcessHeap () returned 0x1130000 [0055.867] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3650080 | out: hHeap=0x1130000) returned 1 [0055.867] GetProcessHeap () returned 0x1130000 [0055.867] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0055.867] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\*") returned 19 [0055.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.868] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\.") returned 19 [0055.868] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.868] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\..") returned 20 [0055.868] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.868] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 33 [0055.868] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.868] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0055.868] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui") returned 33 [0055.868] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.868] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b7d24a, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b7d24a, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0055.868] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\read_me.txt") returned 29 [0055.868] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\read_me.txt" (normalized: "c:\\boot\\fi-fi\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0055.868] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0055.868] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0055.868] CloseHandle (hObject=0x3bc) returned 1 [0055.868] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b7d24a, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b7d24a, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0055.868] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0055.868] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\read_me.txt") returned 29 [0055.868] GetProcessHeap () returned 0x1130000 [0055.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0055.868] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 44 [0055.868] GetProcessHeap () returned 0x1130000 [0055.868] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3660088 | out: hHeap=0x1130000) returned 1 [0055.869] GetProcessHeap () returned 0x1130000 [0055.869] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x120dfc8 [0055.869] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\*") returned 19 [0055.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0055.869] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\.") returned 19 [0055.869] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1b7d24a, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0055.869] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\..") returned 20 [0055.869] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0055.869] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf") returned 30 [0055.869] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.017] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0056.017] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf") returned 30 [0056.017] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.018] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0056.018] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf") returned 30 [0056.018] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.020] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0056.020] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf") returned 30 [0056.020] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.022] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0056.022] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 34 [0056.022] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.023] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0056.023] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf") returned 33 [0056.023] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.024] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0056.024] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 34 [0056.024] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.026] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0056.026] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 33 [0056.026] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.027] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0056.027] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 32 [0056.027] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.027] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0056.027] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf") returned 31 [0056.027] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.028] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0056.028] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 32 [0056.028] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.028] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0056.028] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf") returned 31 [0056.028] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.028] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b7d24a, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1b7d24a, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1cfacfb, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.028] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\read_me.txt") returned 29 [0056.028] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\read_me.txt" (normalized: "c:\\boot\\fonts\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4 [0056.028] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.028] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.028] CloseHandle (hObject=0x3c4) returned 1 [0056.029] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0056.029] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf") returned 34 [0056.029] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.029] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0056.029] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 35 [0056.029] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.029] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0056.029] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 34 [0056.029] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.030] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0056.030] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 31 [0056.030] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.030] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x2e, dwReserved1=0xb40608, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0056.030] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.030] wnsprintfW (in: pszDest=0x120dfc8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\read_me.txt") returned 29 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x120dfc8 | out: hHeap=0x1130000) returned 1 [0056.030] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 45 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3670090 | out: hHeap=0x1130000) returned 1 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0056.030] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0056.030] ReadFile (in: hFile=0x3bc, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175ba8 [0056.030] GetProcessHeap () returned 0x1130000 [0056.030] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.030] GetProcessHeap () returned 0x1130000 [0056.031] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x11758b0 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.031] GetProcessHeap () returned 0x1130000 [0056.031] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.032] GetProcessHeap () returned 0x1130000 [0056.032] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.033] GetProcessHeap () returned 0x1130000 [0056.033] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.033] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.034] GetProcessHeap () returned 0x1130000 [0056.034] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0056.034] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.034] WriteFile (in: hFile=0x3bc, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.035] CloseHandle (hObject=0x3bc) returned 1 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0056.035] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 88 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0056.035] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0056.035] ReadFile (in: hFile=0x3bc, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175ae0 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175950 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.035] GetProcessHeap () returned 0x1130000 [0056.035] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.035] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.036] GetProcessHeap () returned 0x1130000 [0056.036] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.036] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e208 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e208 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.037] GetProcessHeap () returned 0x1130000 [0056.037] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.037] GetProcessHeap () returned 0x1130000 [0056.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.038] GetProcessHeap () returned 0x1130000 [0056.038] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0056.039] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.039] WriteFile (in: hFile=0x3bc, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.039] CloseHandle (hObject=0x3bc) returned 0 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.039] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 89 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.039] GetProcessHeap () returned 0x1130000 [0056.039] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0056.039] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0056.040] ReadFile (in: hFile=0x3b8, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175b08 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175900 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.040] GetProcessHeap () returned 0x1130000 [0056.040] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.041] GetProcessHeap () returned 0x1130000 [0056.041] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.042] GetProcessHeap () returned 0x1130000 [0056.042] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.043] GetProcessHeap () returned 0x1130000 [0056.043] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.043] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.044] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.044] WriteFile (in: hFile=0x3b8, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.044] CloseHandle (hObject=0x3b8) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.044] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 90 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0056.044] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0056.044] ReadFile (in: hFile=0x3b8, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.044] GetProcessHeap () returned 0x1130000 [0056.044] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.044] GetProcessHeap () returned 0x1130000 [0056.045] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175b08 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175a40 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.045] GetProcessHeap () returned 0x1130000 [0056.045] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.045] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779e8 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779e8 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.046] GetProcessHeap () returned 0x1130000 [0056.046] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.047] GetProcessHeap () returned 0x1130000 [0056.047] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.047] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.048] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.048] GetProcessHeap () returned 0x1130000 [0056.049] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.049] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.049] WriteFile (in: hFile=0x3b8, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.049] CloseHandle (hObject=0x3b8) returned 0 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.049] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 91 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0056.049] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0056.049] ReadFile (in: hFile=0x3b8, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175a40 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.049] GetProcessHeap () returned 0x1130000 [0056.049] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.050] GetProcessHeap () returned 0x1130000 [0056.050] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e520 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e520 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.051] GetProcessHeap () returned 0x1130000 [0056.051] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.052] GetProcessHeap () returned 0x1130000 [0056.052] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.052] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0056.053] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.053] WriteFile (in: hFile=0x3b8, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.053] CloseHandle (hObject=0x3b8) returned 0 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0056.053] GetProcessHeap () returned 0x1130000 [0056.053] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.053] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 92 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0056.054] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0056.054] ReadFile (in: hFile=0x3b8, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c88, Size=0x20) returned 0x1175b58 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175860 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.054] GetProcessHeap () returned 0x1130000 [0056.054] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.054] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.055] GetProcessHeap () returned 0x1130000 [0056.055] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.055] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.056] GetProcessHeap () returned 0x1130000 [0056.056] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.056] GetProcessHeap () returned 0x1130000 [0056.057] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.057] GetProcessHeap () returned 0x1130000 [0056.057] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.057] GetProcessHeap () returned 0x1130000 [0056.057] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.057] GetProcessHeap () returned 0x1130000 [0056.057] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.057] GetProcessHeap () returned 0x1130000 [0056.057] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.057] GetProcessHeap () returned 0x1130000 [0056.057] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.057] GetProcessHeap () returned 0x1130000 [0056.057] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.156] GetProcessHeap () returned 0x1130000 [0056.156] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.156] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.157] WriteFile (in: hFile=0x3b8, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.157] CloseHandle (hObject=0x3b8) returned 0 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.157] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 94 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0056.157] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.157] ReadFile (in: hFile=0x3b8, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175b30 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175798 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.157] GetProcessHeap () returned 0x1130000 [0056.157] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.158] GetProcessHeap () returned 0x1130000 [0056.158] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.158] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115de18 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115de18 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x11ddc38 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.159] GetProcessHeap () returned 0x1130000 [0056.159] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.159] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.160] GetProcessHeap () returned 0x1130000 [0056.160] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0056.161] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.161] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.161] CloseHandle (hObject=0x3b8) returned 0 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.161] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 95 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0056.161] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0056.161] GetProcessHeap () returned 0x1130000 [0056.161] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.161] ReadFile (in: hFile=0x3b8, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175950 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11759a0 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.162] GetProcessHeap () returned 0x1130000 [0056.162] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0056.163] GetProcessHeap () returned 0x1130000 [0056.163] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.164] GetProcessHeap () returned 0x1130000 [0056.164] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.165] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.165] GetProcessHeap () returned 0x1130000 [0056.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0056.166] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.166] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.166] CloseHandle (hObject=0x3b8) returned 0 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.166] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 96 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0056.166] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0056.166] ReadFile (in: hFile=0x3b8, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a18 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ae0 [0056.166] GetProcessHeap () returned 0x1130000 [0056.166] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.167] GetProcessHeap () returned 0x1130000 [0056.167] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.167] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.168] GetProcessHeap () returned 0x1130000 [0056.168] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0056.168] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.169] GetProcessHeap () returned 0x1130000 [0056.169] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.170] GetProcessHeap () returned 0x1130000 [0056.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.171] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.171] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.171] CloseHandle (hObject=0x3b8) returned 0 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.171] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 97 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0056.171] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.171] ReadFile (in: hFile=0x3b8, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.171] GetProcessHeap () returned 0x1130000 [0056.171] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0056.171] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175860 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.172] GetProcessHeap () returned 0x1130000 [0056.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177898 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e520 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177898 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e520 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.173] GetProcessHeap () returned 0x1130000 [0056.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.174] GetProcessHeap () returned 0x1130000 [0056.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.175] GetProcessHeap () returned 0x1130000 [0056.175] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.175] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.175] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.175] CloseHandle (hObject=0x3b8) returned 0 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.176] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 98 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0056.176] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.176] ReadFile (in: hFile=0x3b8, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175770 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175b08 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.176] GetProcessHeap () returned 0x1130000 [0056.176] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.176] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.177] GetProcessHeap () returned 0x1130000 [0056.177] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.178] GetProcessHeap () returned 0x1130000 [0056.178] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.178] GetProcessHeap () returned 0x1130000 [0056.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.179] GetProcessHeap () returned 0x1130000 [0056.179] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.179] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0056.180] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.180] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.180] CloseHandle (hObject=0x3b8) returned 0 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.180] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 99 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175900 [0056.180] SystemFunction036 (in: RandomBuffer=0x1175900, RandomBufferLength=0x20 | out: RandomBuffer=0x1175900) returned 1 [0056.180] GetProcessHeap () returned 0x1130000 [0056.180] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.180] ReadFile (in: hFile=0x3b8, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.180] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11759a0 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.181] GetProcessHeap () returned 0x1130000 [0056.181] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e328 [0056.182] GetProcessHeap () returned 0x1130000 [0056.182] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.182] GetProcessHeap () returned 0x1130000 [0056.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e328 | out: hHeap=0x1130000) returned 1 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.183] GetProcessHeap () returned 0x1130000 [0056.183] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.183] GetProcessHeap () returned 0x1130000 [0056.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.184] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.184] GetProcessHeap () returned 0x1130000 [0056.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11759a0 | out: hHeap=0x1130000) returned 1 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.185] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.185] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.185] CloseHandle (hObject=0x3b8) returned 0 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.185] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 100 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0056.185] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0056.185] ReadFile (in: hFile=0x3b8, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150af8, Size=0x20) returned 0x1175770 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11756d0 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.185] GetProcessHeap () returned 0x1130000 [0056.185] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.186] GetProcessHeap () returned 0x1130000 [0056.186] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.186] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177988 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177988 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151f68 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151f68 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x11ddc38 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.187] GetProcessHeap () returned 0x1130000 [0056.187] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.188] GetProcessHeap () returned 0x1130000 [0056.188] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x11ddc38 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddc38 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0056.189] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.189] WriteFile (in: hFile=0x3b8, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.189] CloseHandle (hObject=0x3b8) returned 0 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.189] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 101 [0056.189] GetProcessHeap () returned 0x1130000 [0056.189] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x41000d8 [0056.190] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\*") returned 19 [0056.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1cfacfb, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.190] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\.") returned 19 [0056.190] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1cfacfb, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.190] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\..") returned 20 [0056.190] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.190] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 33 [0056.190] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.190] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1cfacfb, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1cfacfb, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1cfacfb, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.191] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\read_me.txt") returned 29 [0056.191] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\read_me.txt" (normalized: "c:\\boot\\fr-ca\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.191] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.191] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.191] CloseHandle (hObject=0x3b0) returned 1 [0056.191] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1cfacfb, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1cfacfb, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1cfacfb, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.191] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.191] wnsprintfW (in: pszDest=0x41000d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fr-CA\\read_me.txt") returned 29 [0056.191] GetProcessHeap () returned 0x1130000 [0056.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x41000d8 | out: hHeap=0x1130000) returned 1 [0056.191] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 46 [0056.191] GetProcessHeap () returned 0x1130000 [0056.191] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0056.191] GetProcessHeap () returned 0x1130000 [0056.191] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0056.192] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\*") returned 19 [0056.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.192] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\.") returned 19 [0056.192] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.192] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\..") returned 20 [0056.192] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.192] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 33 [0056.192] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.192] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.192] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui") returned 33 [0056.192] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.192] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d20d12, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d20d12, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.192] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\read_me.txt") returned 29 [0056.192] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\read_me.txt" (normalized: "c:\\boot\\fr-fr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.192] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.192] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.192] CloseHandle (hObject=0x3b0) returned 1 [0056.192] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d20d12, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d20d12, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.192] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.192] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\read_me.txt") returned 29 [0056.192] GetProcessHeap () returned 0x1130000 [0056.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0056.193] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 47 [0056.193] GetProcessHeap () returned 0x1130000 [0056.193] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0056.193] GetProcessHeap () returned 0x1130000 [0056.193] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0056.193] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\*") returned 19 [0056.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0056.193] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\.") returned 19 [0056.193] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.193] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\..") returned 20 [0056.193] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.193] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 33 [0056.193] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.193] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d20d12, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d20d12, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.193] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\read_me.txt") returned 29 [0056.193] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\read_me.txt" (normalized: "c:\\boot\\hr-hr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.193] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.193] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.193] CloseHandle (hObject=0x3b0) returned 1 [0056.193] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d20d12, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d20d12, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.193] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0056.194] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\hr-HR\\read_me.txt") returned 29 [0056.194] GetProcessHeap () returned 0x1130000 [0056.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0056.194] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 48 [0056.194] GetProcessHeap () returned 0x1130000 [0056.194] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36a00a8 | out: hHeap=0x1130000) returned 1 [0056.194] GetProcessHeap () returned 0x1130000 [0056.194] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x36a00a8 [0056.194] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\*") returned 19 [0056.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0056.194] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\.") returned 19 [0056.194] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.194] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\..") returned 20 [0056.194] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.194] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 33 [0056.194] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.194] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.194] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui") returned 33 [0056.194] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.194] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d20d12, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d20d12, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.194] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\read_me.txt") returned 29 [0056.194] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\read_me.txt" (normalized: "c:\\boot\\hu-hu\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.194] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.195] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.195] CloseHandle (hObject=0x3b0) returned 1 [0056.195] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d20d12, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d20d12, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.195] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0056.195] wnsprintfW (in: pszDest=0x36a00a8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\read_me.txt") returned 29 [0056.195] GetProcessHeap () returned 0x1130000 [0056.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36a00a8 | out: hHeap=0x1130000) returned 1 [0056.195] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 49 [0056.195] GetProcessHeap () returned 0x1130000 [0056.195] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36b00b0 | out: hHeap=0x1130000) returned 1 [0056.195] GetProcessHeap () returned 0x1130000 [0056.195] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0056.195] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\*") returned 19 [0056.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.195] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\.") returned 19 [0056.195] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.195] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\..") returned 20 [0056.195] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.195] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 33 [0056.195] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.195] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.195] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui") returned 33 [0056.195] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.196] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d20d12, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d20d12, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.196] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\read_me.txt") returned 29 [0056.196] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\read_me.txt" (normalized: "c:\\boot\\it-it\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.196] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.196] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.196] CloseHandle (hObject=0x3b0) returned 1 [0056.196] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d20d12, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d20d12, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d20d12, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.196] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.196] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\read_me.txt") returned 29 [0056.196] GetProcessHeap () returned 0x1130000 [0056.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0056.196] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 50 [0056.196] GetProcessHeap () returned 0x1130000 [0056.196] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11ddfb0 | out: hHeap=0x1130000) returned 1 [0056.196] GetProcessHeap () returned 0x1130000 [0056.196] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0056.196] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\*") returned 19 [0056.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.196] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\.") returned 19 [0056.196] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.196] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\..") returned 20 [0056.196] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.196] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 33 [0056.196] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.197] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.197] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui") returned 33 [0056.197] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.197] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d46e43, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d46e43, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.197] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\read_me.txt") returned 29 [0056.197] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\read_me.txt" (normalized: "c:\\boot\\ja-jp\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0056.197] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.197] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.197] CloseHandle (hObject=0x3b0) returned 1 [0056.197] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d46e43, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d46e43, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.197] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.197] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\read_me.txt") returned 29 [0056.197] GetProcessHeap () returned 0x1130000 [0056.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0056.197] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 51 [0056.197] GetProcessHeap () returned 0x1130000 [0056.197] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11edfb8 | out: hHeap=0x1130000) returned 1 [0056.197] GetProcessHeap () returned 0x1130000 [0056.197] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x118bf78 [0056.197] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\*") returned 19 [0056.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.197] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\.") returned 19 [0056.197] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.198] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\..") returned 20 [0056.248] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.248] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 33 [0056.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.248] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.248] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui") returned 33 [0056.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.248] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d46e43, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d46e43, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.248] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\read_me.txt") returned 29 [0056.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\read_me.txt" (normalized: "c:\\boot\\ko-kr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.248] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.248] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.248] CloseHandle (hObject=0x3a8) returned 1 [0056.248] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d46e43, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d46e43, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.248] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.249] wnsprintfW (in: pszDest=0x118bf78, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\read_me.txt") returned 29 [0056.249] GetProcessHeap () returned 0x1130000 [0056.249] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x118bf78 | out: hHeap=0x1130000) returned 1 [0056.249] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 53 [0056.249] GetProcessHeap () returned 0x1130000 [0056.249] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x35e0048 | out: hHeap=0x1130000) returned 1 [0056.249] GetProcessHeap () returned 0x1130000 [0056.249] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.250] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\*") returned 19 [0056.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.250] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\.") returned 19 [0056.250] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.250] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\..") returned 20 [0056.250] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.250] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 33 [0056.250] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.250] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d46e43, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d46e43, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.250] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\read_me.txt") returned 29 [0056.250] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\read_me.txt" (normalized: "c:\\boot\\lv-lv\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.250] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.250] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.251] CloseHandle (hObject=0x3a8) returned 1 [0056.251] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d46e43, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf1d46e43, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf1d46e43, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.251] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.251] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\lv-LV\\read_me.txt") returned 29 [0056.251] GetProcessHeap () returned 0x1130000 [0056.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.251] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 54 [0056.251] GetProcessHeap () returned 0x1130000 [0056.251] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3600058 | out: hHeap=0x1130000) returned 1 [0056.251] GetProcessHeap () returned 0x1130000 [0056.251] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.251] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\*") returned 19 [0056.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.251] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\.") returned 19 [0056.251] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.251] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\..") returned 20 [0056.251] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.251] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 33 [0056.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.251] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.251] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui") returned 33 [0056.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.252] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21bf8aa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21bf8aa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.252] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\read_me.txt") returned 29 [0056.252] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\read_me.txt" (normalized: "c:\\boot\\nb-no\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.252] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.252] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.252] CloseHandle (hObject=0x3a8) returned 1 [0056.252] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21bf8aa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21bf8aa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x25, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.252] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.252] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\read_me.txt") returned 29 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.252] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 55 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3610060 | out: hHeap=0x1130000) returned 1 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0056.252] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.252] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175928 [0056.252] GetProcessHeap () returned 0x1130000 [0056.252] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b58, Size=0x20) returned 0x1175b08 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.253] GetProcessHeap () returned 0x1130000 [0056.253] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.253] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.254] GetProcessHeap () returned 0x1130000 [0056.254] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.255] GetProcessHeap () returned 0x1130000 [0056.255] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.256] GetProcessHeap () returned 0x1130000 [0056.256] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0056.256] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.256] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.256] CloseHandle (hObject=0x3c0) returned 0 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.257] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 102 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11757c0 [0056.257] SystemFunction036 (in: RandomBuffer=0x11757c0, RandomBufferLength=0x20 | out: RandomBuffer=0x11757c0) returned 1 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.257] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x1175900 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175950 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.257] GetProcessHeap () returned 0x1130000 [0056.257] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.258] GetProcessHeap () returned 0x1130000 [0056.258] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.259] GetProcessHeap () returned 0x1130000 [0056.259] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.260] GetProcessHeap () returned 0x1130000 [0056.260] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0056.261] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.261] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.261] CloseHandle (hObject=0x3c0) returned 0 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.261] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 103 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.261] GetProcessHeap () returned 0x1130000 [0056.261] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756d0 [0056.261] SystemFunction036 (in: RandomBuffer=0x11756d0, RandomBufferLength=0x20 | out: RandomBuffer=0x11756d0) returned 1 [0056.261] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.262] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ae8, Size=0x20) returned 0x1175a18 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175a40 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.262] GetProcessHeap () returned 0x1130000 [0056.262] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.263] GetProcessHeap () returned 0x1130000 [0056.263] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.263] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.264] GetProcessHeap () returned 0x1130000 [0056.264] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.264] GetProcessHeap () returned 0x1130000 [0056.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.265] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.265] GetProcessHeap () returned 0x1130000 [0056.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.266] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.266] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.266] CloseHandle (hObject=0x3c0) returned 0 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.266] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 104 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0056.266] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.266] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150ba8, Size=0x20) returned 0x11756f8 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175b08 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.266] GetProcessHeap () returned 0x1130000 [0056.266] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.266] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.267] GetProcessHeap () returned 0x1130000 [0056.267] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177838 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e520 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177838 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e520 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.268] GetProcessHeap () returned 0x1130000 [0056.268] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.269] GetProcessHeap () returned 0x1130000 [0056.269] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0056.270] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.270] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.270] CloseHandle (hObject=0x3c0) returned 0 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0056.270] GetProcessHeap () returned 0x1130000 [0056.270] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.270] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 105 [0056.270] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0056.271] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.271] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175950 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175770 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.271] GetProcessHeap () returned 0x1130000 [0056.271] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.272] GetProcessHeap () returned 0x1130000 [0056.272] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177898 [0056.272] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e010 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177898 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e010 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.273] GetProcessHeap () returned 0x1130000 [0056.273] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.274] GetProcessHeap () returned 0x1130000 [0056.274] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0056.275] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.275] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.275] CloseHandle (hObject=0x3c0) returned 0 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.275] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 106 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0056.275] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.275] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175888 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.275] GetProcessHeap () returned 0x1130000 [0056.275] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.276] GetProcessHeap () returned 0x1130000 [0056.276] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b68 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b68 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.277] GetProcessHeap () returned 0x1130000 [0056.277] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.278] GetProcessHeap () returned 0x1130000 [0056.278] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.279] GetProcessHeap () returned 0x1130000 [0056.279] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0056.279] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.279] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.279] CloseHandle (hObject=0x3c0) returned 0 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0056.280] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 107 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0056.280] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.280] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150af8, Size=0x20) returned 0x1175770 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.280] GetProcessHeap () returned 0x1130000 [0056.280] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.281] GetProcessHeap () returned 0x1130000 [0056.281] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.281] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.282] GetProcessHeap () returned 0x1130000 [0056.282] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.283] GetProcessHeap () returned 0x1130000 [0056.283] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.283] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0056.284] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.284] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.284] CloseHandle (hObject=0x3c0) returned 0 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0056.284] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 108 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0056.284] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.284] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.284] GetProcessHeap () returned 0x1130000 [0056.284] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.284] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175928 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175a90 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.285] GetProcessHeap () returned 0x1130000 [0056.285] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0056.286] GetProcessHeap () returned 0x1130000 [0056.286] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0056.286] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x121eaa0 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca0 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x1156160 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca0 | out: hHeap=0x1130000) returned 1 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.287] GetProcessHeap () returned 0x1130000 [0056.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x1156160 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1156160 | out: hHeap=0x1130000) returned 1 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0056.288] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.288] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.288] CloseHandle (hObject=0x3c0) returned 0 [0056.288] GetProcessHeap () returned 0x1130000 [0056.288] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.289] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 109 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0056.289] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.289] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b68, Size=0x20) returned 0x11756f8 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.289] GetProcessHeap () returned 0x1130000 [0056.289] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.290] GetProcessHeap () returned 0x1130000 [0056.290] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777d8 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777d8 | out: hHeap=0x1130000) returned 1 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.291] GetProcessHeap () returned 0x1130000 [0056.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.306] GetProcessHeap () returned 0x1130000 [0056.306] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.307] GetProcessHeap () returned 0x1130000 [0056.307] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0056.308] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.308] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.308] CloseHandle (hObject=0x3c0) returned 0 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0056.308] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 111 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0056.308] GetProcessHeap () returned 0x1130000 [0056.308] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0056.308] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.309] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175928 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175a18 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.309] GetProcessHeap () returned 0x1130000 [0056.309] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177808 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0056.310] GetProcessHeap () returned 0x1130000 [0056.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177808 | out: hHeap=0x1130000) returned 1 [0056.310] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11528f8 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11528f8 | out: hHeap=0x1130000) returned 1 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.311] GetProcessHeap () returned 0x1130000 [0056.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.312] GetProcessHeap () returned 0x1130000 [0056.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0056.313] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.313] WriteFile (in: hFile=0x3c0, lpBuffer=0x11539b0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.313] CloseHandle (hObject=0x3c0) returned 0 [0056.313] GetProcessHeap () returned 0x1130000 [0056.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.313] GetProcessHeap () returned 0x1130000 [0056.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.313] GetProcessHeap () returned 0x1130000 [0056.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0056.313] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 112 [0056.313] GetProcessHeap () returned 0x1130000 [0056.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3970110 [0056.313] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\*") returned 19 [0056.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.313] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\.") returned 19 [0056.313] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.313] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\..") returned 20 [0056.313] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.313] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 33 [0056.313] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.313] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.313] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui") returned 33 [0056.313] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.313] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21bf8aa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21bf8aa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.313] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\read_me.txt") returned 29 [0056.314] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\read_me.txt" (normalized: "c:\\boot\\nl-nl\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.314] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.314] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.314] CloseHandle (hObject=0x3a8) returned 1 [0056.314] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21bf8aa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21bf8aa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.314] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.314] wnsprintfW (in: pszDest=0x3970110, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\read_me.txt") returned 29 [0056.314] GetProcessHeap () returned 0x1130000 [0056.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3970110 | out: hHeap=0x1130000) returned 1 [0056.314] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 56 [0056.314] GetProcessHeap () returned 0x1130000 [0056.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.314] GetProcessHeap () returned 0x1130000 [0056.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.314] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\*") returned 19 [0056.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170b60 [0056.314] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\.") returned 19 [0056.314] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.314] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\..") returned 20 [0056.314] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.314] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 33 [0056.314] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.315] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.315] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui") returned 33 [0056.315] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.315] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21bf8aa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21bf8aa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.315] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\read_me.txt") returned 29 [0056.315] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\read_me.txt" (normalized: "c:\\boot\\pl-pl\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.315] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.315] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.315] CloseHandle (hObject=0x3a8) returned 1 [0056.315] FindNextFileW (in: hFindFile=0x1170b60, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21bf8aa, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21bf8aa, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21bf8aa, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.315] FindClose (in: hFindFile=0x1170b60 | out: hFindFile=0x1170b60) returned 1 [0056.315] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\read_me.txt") returned 29 [0056.315] GetProcessHeap () returned 0x1130000 [0056.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.315] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 57 [0056.315] GetProcessHeap () returned 0x1130000 [0056.315] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11fdfc0 | out: hHeap=0x1130000) returned 1 [0056.316] GetProcessHeap () returned 0x1130000 [0056.316] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.316] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\*") returned 19 [0056.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.316] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\.") returned 19 [0056.316] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.316] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\..") returned 20 [0056.316] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.316] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 33 [0056.316] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.316] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.316] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui") returned 33 [0056.316] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.316] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.316] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\read_me.txt") returned 29 [0056.316] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\read_me.txt" (normalized: "c:\\boot\\pt-br\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.316] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.316] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.316] CloseHandle (hObject=0x3a8) returned 1 [0056.317] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.317] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.317] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\read_me.txt") returned 29 [0056.317] GetProcessHeap () returned 0x1130000 [0056.317] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.317] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 58 [0056.317] GetProcessHeap () returned 0x1130000 [0056.317] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.320] GetProcessHeap () returned 0x1130000 [0056.320] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38900a0 [0056.321] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\*") returned 19 [0056.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.321] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\.") returned 19 [0056.321] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.321] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\..") returned 20 [0056.321] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.321] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 33 [0056.321] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.321] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.321] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui") returned 33 [0056.321] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.322] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.322] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt") returned 29 [0056.322] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt" (normalized: "c:\\boot\\pt-pt\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.322] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.322] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.322] CloseHandle (hObject=0x3a8) returned 1 [0056.322] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.322] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.322] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt") returned 29 [0056.322] GetProcessHeap () returned 0x1130000 [0056.322] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.322] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 59 [0056.322] GetProcessHeap () returned 0x1130000 [0056.322] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3620068 | out: hHeap=0x1130000) returned 1 [0056.323] GetProcessHeap () returned 0x1130000 [0056.323] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38900a0 [0056.323] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\*") returned 22 [0056.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0056.323] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\.") returned 22 [0056.323] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.323] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\..") returned 23 [0056.323] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.323] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 36 [0056.323] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.323] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.324] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 36 [0056.324] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.324] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.324] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\read_me.txt") returned 32 [0056.324] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\read_me.txt" (normalized: "c:\\boot\\qps-ploc\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.324] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.324] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.324] CloseHandle (hObject=0x3a8) returned 1 [0056.324] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.324] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0056.324] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\qps-ploc\\read_me.txt") returned 32 [0056.324] GetProcessHeap () returned 0x1130000 [0056.324] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.324] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 60 [0056.324] GetProcessHeap () returned 0x1130000 [0056.324] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3630070 | out: hHeap=0x1130000) returned 1 [0056.324] GetProcessHeap () returned 0x1130000 [0056.324] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x38900a0 [0056.324] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\*") returned 23 [0056.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.324] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\.") returned 23 [0056.324] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.325] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\..") returned 24 [0056.325] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0056.325] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\bootres.dll") returned 33 [0056.325] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.325] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.325] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US") returned 27 [0056.325] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf220bc46, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.325] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\read_me.txt") returned 33 [0056.325] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\read_me.txt" (normalized: "c:\\boot\\resources\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.325] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.325] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.325] CloseHandle (hObject=0x3a8) returned 1 [0056.325] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf220bc46, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.325] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.325] wnsprintfW (in: pszDest=0x38900a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\read_me.txt") returned 33 [0056.325] GetProcessHeap () returned 0x1130000 [0056.325] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.325] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 61 [0056.325] GetProcessHeap () returned 0x1130000 [0056.325] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37e0048 | out: hHeap=0x1130000) returned 1 [0056.325] GetProcessHeap () returned 0x1130000 [0056.325] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37e0048 [0056.325] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\*") returned 29 [0056.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.326] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\.") returned 29 [0056.326] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.326] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\..") returned 30 [0056.326] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0056.326] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 43 [0056.326] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.326] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.326] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\read_me.txt") returned 39 [0056.326] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\read_me.txt" (normalized: "c:\\boot\\resources\\en-us\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.326] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.326] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.326] CloseHandle (hObject=0x3a8) returned 1 [0056.326] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e5781, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf21e5781, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf21e5781, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.326] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.326] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\Resources\\en-US\\read_me.txt") returned 39 [0056.326] GetProcessHeap () returned 0x1130000 [0056.326] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37e0048 | out: hHeap=0x1130000) returned 1 [0056.326] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 62 [0056.326] GetProcessHeap () returned 0x1130000 [0056.326] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38a00a8 | out: hHeap=0x1130000) returned 1 [0056.326] GetProcessHeap () returned 0x1130000 [0056.326] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x37e0048 [0056.326] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\*") returned 19 [0056.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf220bc46, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.327] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\.") returned 19 [0056.327] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf220bc46, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.327] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\..") returned 20 [0056.327] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.327] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 33 [0056.327] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.327] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf220bc46, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf220bc46, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf220bc46, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.327] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\read_me.txt") returned 29 [0056.327] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\read_me.txt" (normalized: "c:\\boot\\ro-ro\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.327] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.327] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.327] CloseHandle (hObject=0x3a8) returned 1 [0056.327] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf220bc46, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf220bc46, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf220bc46, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.327] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.327] wnsprintfW (in: pszDest=0x37e0048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ro-RO\\read_me.txt") returned 29 [0056.327] GetProcessHeap () returned 0x1130000 [0056.327] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37e0048 | out: hHeap=0x1130000) returned 1 [0056.327] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 63 [0056.327] GetProcessHeap () returned 0x1130000 [0056.327] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x37f0050 | out: hHeap=0x1130000) returned 1 [0056.327] GetProcessHeap () returned 0x1130000 [0056.327] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.328] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\*") returned 19 [0056.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.328] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\.") returned 19 [0056.328] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.328] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\..") returned 20 [0056.328] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.328] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 33 [0056.329] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.329] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.329] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui") returned 33 [0056.329] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.329] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23af4df, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23af4df, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.329] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\read_me.txt") returned 29 [0056.329] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\read_me.txt" (normalized: "c:\\boot\\ru-ru\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.329] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.329] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.329] CloseHandle (hObject=0x3a8) returned 1 [0056.329] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23af4df, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23af4df, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.329] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.329] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\read_me.txt") returned 29 [0056.329] GetProcessHeap () returned 0x1130000 [0056.329] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.329] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 64 [0056.329] GetProcessHeap () returned 0x1130000 [0056.329] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38b00b0 | out: hHeap=0x1130000) returned 1 [0056.329] GetProcessHeap () returned 0x1130000 [0056.329] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.329] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\*") returned 19 [0056.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.330] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\.") returned 19 [0056.330] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.330] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\..") returned 20 [0056.330] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.330] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 33 [0056.330] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.330] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23af4df, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23af4df, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.330] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\read_me.txt") returned 29 [0056.330] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\read_me.txt" (normalized: "c:\\boot\\sk-sk\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.331] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.331] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.331] CloseHandle (hObject=0x3a8) returned 1 [0056.331] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23af4df, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23af4df, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.331] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.331] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sk-SK\\read_me.txt") returned 29 [0056.331] GetProcessHeap () returned 0x1130000 [0056.331] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.331] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 65 [0056.331] GetProcessHeap () returned 0x1130000 [0056.331] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38c00b8 | out: hHeap=0x1130000) returned 1 [0056.334] GetProcessHeap () returned 0x1130000 [0056.334] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.335] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\*") returned 19 [0056.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.335] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\.") returned 19 [0056.335] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.335] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\..") returned 20 [0056.335] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.335] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 33 [0056.336] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.336] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23af4df, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23af4df, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.336] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\read_me.txt") returned 29 [0056.336] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\read_me.txt" (normalized: "c:\\boot\\sl-si\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.336] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.336] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.336] CloseHandle (hObject=0x3a8) returned 1 [0056.336] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23af4df, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23af4df, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.336] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.336] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sl-SI\\read_me.txt") returned 29 [0056.336] GetProcessHeap () returned 0x1130000 [0056.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.336] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 66 [0056.336] GetProcessHeap () returned 0x1130000 [0056.336] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38d00c0 | out: hHeap=0x1130000) returned 1 [0056.337] GetProcessHeap () returned 0x1130000 [0056.337] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.337] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\*") returned 24 [0056.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.337] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\.") returned 24 [0056.337] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.337] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\..") returned 25 [0056.337] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.337] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 38 [0056.337] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.337] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.337] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 38 [0056.337] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.337] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23af4df, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23af4df, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.338] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\read_me.txt") returned 34 [0056.338] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\read_me.txt" (normalized: "c:\\boot\\sr-latn-cs\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.338] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.338] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.338] CloseHandle (hObject=0x3a8) returned 1 [0056.338] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23af4df, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23af4df, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23af4df, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.338] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.338] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-CS\\read_me.txt") returned 34 [0056.338] GetProcessHeap () returned 0x1130000 [0056.338] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.338] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 67 [0056.338] GetProcessHeap () returned 0x1130000 [0056.338] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38e00c8 | out: hHeap=0x1130000) returned 1 [0056.338] GetProcessHeap () returned 0x1130000 [0056.338] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.339] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\*") returned 24 [0056.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170c20 [0056.339] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\.") returned 24 [0056.339] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.339] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\..") returned 25 [0056.339] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.339] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 38 [0056.339] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.339] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23d560e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23d560e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.339] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\read_me.txt") returned 34 [0056.339] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\read_me.txt" (normalized: "c:\\boot\\sr-latn-rs\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.339] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.339] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.339] CloseHandle (hObject=0x3a8) returned 1 [0056.339] FindNextFileW (in: hFindFile=0x1170c20, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23d560e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23d560e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.339] FindClose (in: hFindFile=0x1170c20 | out: hFindFile=0x1170c20) returned 1 [0056.340] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sr-Latn-RS\\read_me.txt") returned 34 [0056.340] GetProcessHeap () returned 0x1130000 [0056.340] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.340] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 68 [0056.340] GetProcessHeap () returned 0x1130000 [0056.340] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38f00d0 | out: hHeap=0x1130000) returned 1 [0056.340] GetProcessHeap () returned 0x1130000 [0056.340] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.340] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\*") returned 19 [0056.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.340] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\.") returned 19 [0056.340] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.340] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\..") returned 20 [0056.340] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.340] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 33 [0056.340] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.340] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.340] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui") returned 33 [0056.340] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.340] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23d560e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23d560e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.340] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt") returned 29 [0056.340] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt" (normalized: "c:\\boot\\sv-se\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.340] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.341] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.341] CloseHandle (hObject=0x3a8) returned 1 [0056.341] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23d560e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23d560e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.341] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.341] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt") returned 29 [0056.341] GetProcessHeap () returned 0x1130000 [0056.341] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.341] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 69 [0056.341] GetProcessHeap () returned 0x1130000 [0056.341] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39000d8 | out: hHeap=0x1130000) returned 1 [0056.343] GetProcessHeap () returned 0x1130000 [0056.343] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.343] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\*") returned 19 [0056.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.343] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\.") returned 19 [0056.343] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.343] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\..") returned 20 [0056.343] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.343] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 33 [0056.343] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.343] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.343] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui") returned 33 [0056.343] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.343] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23d560e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23d560e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.343] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\read_me.txt") returned 29 [0056.343] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\read_me.txt" (normalized: "c:\\boot\\tr-tr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.343] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.343] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.343] CloseHandle (hObject=0x3a8) returned 1 [0056.343] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23d560e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23d560e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.344] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.344] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\read_me.txt") returned 29 [0056.344] GetProcessHeap () returned 0x1130000 [0056.344] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.344] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 70 [0056.344] GetProcessHeap () returned 0x1130000 [0056.344] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39100e0 | out: hHeap=0x1130000) returned 1 [0056.344] GetProcessHeap () returned 0x1130000 [0056.344] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.344] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\*") returned 19 [0056.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.344] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\.") returned 19 [0056.344] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.344] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\..") returned 20 [0056.344] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.344] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 33 [0056.344] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.344] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23d560e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23d560e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.344] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\read_me.txt") returned 29 [0056.344] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\read_me.txt" (normalized: "c:\\boot\\uk-ua\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.344] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.344] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.344] CloseHandle (hObject=0x3a8) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23d560e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23d560e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23d560e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.345] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.345] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\uk-UA\\read_me.txt") returned 29 [0056.345] GetProcessHeap () returned 0x1130000 [0056.345] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.345] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 71 [0056.345] GetProcessHeap () returned 0x1130000 [0056.345] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39200e8 | out: hHeap=0x1130000) returned 1 [0056.345] GetProcessHeap () returned 0x1130000 [0056.345] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.345] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\*") returned 19 [0056.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23fb8e2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0056.345] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\.") returned 19 [0056.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23fb8e2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.345] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\..") returned 20 [0056.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.345] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 33 [0056.345] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.345] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui") returned 33 [0056.345] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.345] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23fb8e2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23fb8e2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23fb8e2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.345] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt") returned 29 [0056.345] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt" (normalized: "c:\\boot\\zh-cn\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.346] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.346] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.346] CloseHandle (hObject=0x3a8) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23fb8e2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23fb8e2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23fb8e2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.346] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0056.346] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt") returned 29 [0056.346] GetProcessHeap () returned 0x1130000 [0056.346] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.346] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 72 [0056.346] GetProcessHeap () returned 0x1130000 [0056.346] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39300f0 | out: hHeap=0x1130000) returned 1 [0056.346] GetProcessHeap () returned 0x1130000 [0056.346] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.346] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\*") returned 19 [0056.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23fb8e2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0056.346] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\.") returned 19 [0056.346] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf23fb8e2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.346] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\..") returned 20 [0056.346] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.346] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 33 [0056.346] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.346] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.347] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui") returned 33 [0056.347] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.347] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23fb8e2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23fb8e2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23fb8e2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.347] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\read_me.txt") returned 29 [0056.347] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\read_me.txt" (normalized: "c:\\boot\\zh-hk\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.347] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.347] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.347] CloseHandle (hObject=0x3a8) returned 1 [0056.347] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23fb8e2, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf23fb8e2, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf23fb8e2, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.347] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0056.347] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\read_me.txt") returned 29 [0056.347] GetProcessHeap () returned 0x1130000 [0056.347] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.347] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 73 [0056.347] GetProcessHeap () returned 0x1130000 [0056.347] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x39400f8 | out: hHeap=0x1130000) returned 1 [0056.349] GetProcessHeap () returned 0x1130000 [0056.349] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.350] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\*") returned 19 [0056.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf252cdd4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.350] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\.") returned 19 [0056.350] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf252cdd4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.350] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\..") returned 20 [0056.350] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0056.350] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 33 [0056.350] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.350] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0056.350] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui") returned 33 [0056.350] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0056.350] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf252cdd4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf252cdd4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf26aa53f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.350] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt") returned 29 [0056.350] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt" (normalized: "c:\\boot\\zh-tw\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.350] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.350] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.350] CloseHandle (hObject=0x3a8) returned 1 [0056.350] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf252cdd4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf252cdd4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf26aa53f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.351] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.351] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt") returned 29 [0056.351] GetProcessHeap () returned 0x1130000 [0056.351] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.351] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 74 [0056.351] GetProcessHeap () returned 0x1130000 [0056.351] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3950100 | out: hHeap=0x1130000) returned 1 [0056.351] GetProcessHeap () returned 0x1130000 [0056.351] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.351] GetProcessHeap () returned 0x1130000 [0056.351] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11758b0 [0056.352] SystemFunction036 (in: RandomBuffer=0x11758b0, RandomBufferLength=0x20 | out: RandomBuffer=0x11758b0) returned 1 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.352] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b68, Size=0x20) returned 0x1175860 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175900 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.352] GetProcessHeap () returned 0x1130000 [0056.352] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0056.353] GetProcessHeap () returned 0x1130000 [0056.353] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152650 [0056.354] GetProcessHeap () returned 0x1130000 [0056.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.354] GetProcessHeap () returned 0x1130000 [0056.354] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0056.354] GetProcessHeap () returned 0x1130000 [0056.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152650 | out: hHeap=0x1130000) returned 1 [0056.354] GetProcessHeap () returned 0x1130000 [0056.354] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.354] GetProcessHeap () returned 0x1130000 [0056.354] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0056.354] GetProcessHeap () returned 0x1130000 [0056.422] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.422] GetProcessHeap () returned 0x1130000 [0056.422] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.423] GetProcessHeap () returned 0x1130000 [0056.423] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.424] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.424] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.424] CloseHandle (hObject=0x3c0) returned 0 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.424] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 114 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0056.424] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.424] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11758b0 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175748 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.424] GetProcessHeap () returned 0x1130000 [0056.424] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.425] GetProcessHeap () returned 0x1130000 [0056.425] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.425] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177898 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177898 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0056.426] GetProcessHeap () returned 0x1130000 [0056.426] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.427] GetProcessHeap () returned 0x1130000 [0056.427] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.427] GetProcessHeap () returned 0x1130000 [0056.428] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758b0 | out: hHeap=0x1130000) returned 1 [0056.428] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.428] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.428] CloseHandle (hObject=0x3c0) returned 0 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.428] GetProcessHeap () returned 0x1130000 [0056.428] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.429] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 115 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0056.429] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.429] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175ab8 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.429] GetProcessHeap () returned 0x1130000 [0056.429] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.430] GetProcessHeap () returned 0x1130000 [0056.430] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.430] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.431] GetProcessHeap () returned 0x1130000 [0056.431] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.431] GetProcessHeap () returned 0x1130000 [0056.432] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.432] GetProcessHeap () returned 0x1130000 [0056.432] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.433] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.433] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.433] CloseHandle (hObject=0x3c0) returned 0 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.433] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 116 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.433] GetProcessHeap () returned 0x1130000 [0056.433] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175888 [0056.434] SystemFunction036 (in: RandomBuffer=0x1175888, RandomBufferLength=0x20 | out: RandomBuffer=0x1175888) returned 1 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.434] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175b30 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175a40 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.434] GetProcessHeap () returned 0x1130000 [0056.434] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177aa8 [0056.435] GetProcessHeap () returned 0x1130000 [0056.435] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.435] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177aa8 | out: hHeap=0x1130000) returned 1 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.436] GetProcessHeap () returned 0x1130000 [0056.436] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.437] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.437] GetProcessHeap () returned 0x1130000 [0056.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0056.438] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.438] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.438] CloseHandle (hObject=0x3c0) returned 0 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.438] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 117 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0056.438] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.438] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175888 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x1175a18 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.438] GetProcessHeap () returned 0x1130000 [0056.438] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.438] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.439] GetProcessHeap () returned 0x1130000 [0056.439] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.440] GetProcessHeap () returned 0x1130000 [0056.440] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.441] GetProcessHeap () returned 0x1130000 [0056.441] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0056.442] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.442] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.442] CloseHandle (hObject=0x3c0) returned 0 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0056.442] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 118 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0056.442] GetProcessHeap () returned 0x1130000 [0056.442] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0056.442] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.443] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175a18 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bc8, Size=0x20) returned 0x11757c0 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.443] GetProcessHeap () returned 0x1130000 [0056.443] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.443] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177a18 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.444] GetProcessHeap () returned 0x1130000 [0056.444] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.444] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177a18 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.445] GetProcessHeap () returned 0x1130000 [0056.445] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.446] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11757c0 | out: hHeap=0x1130000) returned 1 [0056.446] GetProcessHeap () returned 0x1130000 [0056.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.447] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.447] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153380, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.447] CloseHandle (hObject=0x3c0) returned 0 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0056.447] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 119 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0056.447] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.447] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175720 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175ae0 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.447] GetProcessHeap () returned 0x1130000 [0056.447] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.448] GetProcessHeap () returned 0x1130000 [0056.448] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779e8 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779e8 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152298 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152298 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x1f8) returned 0x121eaa0 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca0 [0056.449] GetProcessHeap () returned 0x1130000 [0056.449] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x38900a0 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca0 | out: hHeap=0x1130000) returned 1 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.450] GetProcessHeap () returned 0x1130000 [0056.450] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.450] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x38900a0 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x38900a0 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0056.451] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.451] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.451] CloseHandle (hObject=0x3c0) returned 0 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0056.451] GetProcessHeap () returned 0x1130000 [0056.451] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.451] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 120 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ba8 [0056.452] SystemFunction036 (in: RandomBuffer=0x1175ba8, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ba8) returned 1 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.452] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150af8, Size=0x20) returned 0x1175a18 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x1175ab8 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.452] GetProcessHeap () returned 0x1130000 [0056.452] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.452] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.453] GetProcessHeap () returned 0x1130000 [0056.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.453] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.454] GetProcessHeap () returned 0x1130000 [0056.454] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.454] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.455] GetProcessHeap () returned 0x1130000 [0056.455] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ab8 | out: hHeap=0x1130000) returned 1 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.456] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.456] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.456] CloseHandle (hObject=0x3c0) returned 0 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.456] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 121 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175ae0 [0056.456] SystemFunction036 (in: RandomBuffer=0x1175ae0, RandomBufferLength=0x20 | out: RandomBuffer=0x1175ae0) returned 1 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.456] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x11758d8 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.456] GetProcessHeap () returned 0x1130000 [0056.456] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x11756f8 [0056.456] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.457] GetProcessHeap () returned 0x1130000 [0056.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152210 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.458] GetProcessHeap () returned 0x1130000 [0056.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152210 | out: hHeap=0x1130000) returned 1 [0056.458] GetProcessHeap () returned 0x1130000 [0056.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.459] GetProcessHeap () returned 0x1130000 [0056.459] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.459] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.460] GetProcessHeap () returned 0x1130000 [0056.460] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0056.460] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.460] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.461] CloseHandle (hObject=0x3c0) returned 0 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ae0 | out: hHeap=0x1130000) returned 1 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.461] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 122 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0056.461] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.461] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175798 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c88 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c88, Size=0x20) returned 0x1175770 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.461] GetProcessHeap () returned 0x1130000 [0056.461] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.462] GetProcessHeap () returned 0x1130000 [0056.462] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.463] GetProcessHeap () returned 0x1130000 [0056.463] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0056.463] GetProcessHeap () returned 0x1130000 [0056.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.485] GetProcessHeap () returned 0x1130000 [0056.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.486] GetProcessHeap () returned 0x1130000 [0056.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0056.487] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.487] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.487] CloseHandle (hObject=0x3c0) returned 0 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.487] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 124 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.487] GetProcessHeap () returned 0x1130000 [0056.487] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0056.487] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.488] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x11756f8 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175860 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.488] GetProcessHeap () returned 0x1130000 [0056.488] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0056.489] GetProcessHeap () returned 0x1130000 [0056.489] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.490] GetProcessHeap () returned 0x1130000 [0056.490] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.491] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.491] GetProcessHeap () returned 0x1130000 [0056.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0056.492] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.492] WriteFile (in: hFile=0x3c0, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.492] CloseHandle (hObject=0x3c0) returned 0 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.492] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 125 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0056.492] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.492] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x1175b30 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11756d0 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.492] GetProcessHeap () returned 0x1130000 [0056.492] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.493] GetProcessHeap () returned 0x1130000 [0056.493] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e2e0 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11527e8 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e2e0 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11527e8 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.494] GetProcessHeap () returned 0x1130000 [0056.494] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.495] GetProcessHeap () returned 0x1130000 [0056.495] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0056.496] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.496] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.496] CloseHandle (hObject=0x3c0) returned 0 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.496] GetProcessHeap () returned 0x1130000 [0056.496] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.497] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 126 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b58 [0056.497] SystemFunction036 (in: RandomBuffer=0x1175b58, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b58) returned 1 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.497] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150af8, Size=0x20) returned 0x1175770 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b78, Size=0x20) returned 0x1175ba8 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.497] GetProcessHeap () returned 0x1130000 [0056.497] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.498] GetProcessHeap () returned 0x1130000 [0056.498] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11778c8 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11778c8 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.499] GetProcessHeap () returned 0x1130000 [0056.499] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.500] GetProcessHeap () returned 0x1130000 [0056.500] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0056.501] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.501] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.501] CloseHandle (hObject=0x3c0) returned 0 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.501] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 127 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0056.501] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.501] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.501] GetProcessHeap () returned 0x1130000 [0056.501] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bc8, Size=0x20) returned 0x1175928 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c68, Size=0x20) returned 0x11758d8 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.502] GetProcessHeap () returned 0x1130000 [0056.502] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.502] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11777a8 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0056.503] GetProcessHeap () returned 0x1130000 [0056.503] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11777a8 | out: hHeap=0x1130000) returned 1 [0056.503] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.504] GetProcessHeap () returned 0x1130000 [0056.504] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.505] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.505] GetProcessHeap () returned 0x1130000 [0056.506] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0056.506] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.506] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153590, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.506] CloseHandle (hObject=0x3c0) returned 0 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.506] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 128 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0056.506] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0056.506] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x11756d0 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175a68 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.506] GetProcessHeap () returned 0x1130000 [0056.506] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.507] GetProcessHeap () returned 0x1130000 [0056.507] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151e58 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153bc0 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151e58 | out: hHeap=0x1130000) returned 1 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.508] GetProcessHeap () returned 0x1130000 [0056.508] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153bc0 | out: hHeap=0x1130000) returned 1 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.509] GetProcessHeap () returned 0x1130000 [0056.509] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.510] GetProcessHeap () returned 0x1130000 [0056.510] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0056.510] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.511] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.511] CloseHandle (hObject=0x3c0) returned 0 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0056.511] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 129 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a18 [0056.511] SystemFunction036 (in: RandomBuffer=0x1175a18, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a18) returned 1 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.511] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175a90 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175928 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c98 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0056.511] GetProcessHeap () returned 0x1130000 [0056.511] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.511] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.512] GetProcessHeap () returned 0x1130000 [0056.512] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11776e8 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11776e8 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.513] GetProcessHeap () returned 0x1130000 [0056.513] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.513] GetProcessHeap () returned 0x1130000 [0056.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.514] GetProcessHeap () returned 0x1130000 [0056.514] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a90 | out: hHeap=0x1130000) returned 1 [0056.515] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.515] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.515] CloseHandle (hObject=0x3c0) returned 0 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.515] GetProcessHeap () returned 0x1130000 [0056.515] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0056.515] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 130 [0056.515] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153ab8 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b08 [0056.516] SystemFunction036 (in: RandomBuffer=0x1175b08, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b08) returned 1 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.516] ReadFile (in: hFile=0x3c0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a18 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150bb8, Size=0x20) returned 0x1175770 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0056.516] GetProcessHeap () returned 0x1130000 [0056.516] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.516] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0056.517] GetProcessHeap () returned 0x1130000 [0056.517] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.518] GetProcessHeap () returned 0x1130000 [0056.518] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.518] GetProcessHeap () returned 0x1130000 [0056.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.519] GetProcessHeap () returned 0x1130000 [0056.519] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a18 | out: hHeap=0x1130000) returned 1 [0056.520] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.520] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153ab8, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.520] CloseHandle (hObject=0x3c0) returned 0 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b08 | out: hHeap=0x1130000) returned 1 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153ab8 | out: hHeap=0x1130000) returned 1 [0056.520] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 131 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175770 [0056.520] SystemFunction036 (in: RandomBuffer=0x1175770, RandomBufferLength=0x20 | out: RandomBuffer=0x1175770) returned 1 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0056.520] ReadFile (in: hFile=0x3ac, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x1175a40 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175900 [0056.520] GetProcessHeap () returned 0x1130000 [0056.520] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0056.520] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.521] GetProcessHeap () returned 0x1130000 [0056.521] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177c88 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177c88 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153590 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.522] GetProcessHeap () returned 0x1130000 [0056.522] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153590 | out: hHeap=0x1130000) returned 1 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.523] GetProcessHeap () returned 0x1130000 [0056.523] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eca8 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121eaa0 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121eca8 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eaa0 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121eca8 | out: hHeap=0x1130000) returned 1 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0056.524] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0056.524] WriteFile (in: hFile=0x3ac, lpBuffer=0x11537a0, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0056.524] CloseHandle (hObject=0x3ac) returned 0 [0056.524] GetProcessHeap () returned 0x1130000 [0056.524] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0056.525] GetProcessHeap () returned 0x1130000 [0056.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0056.525] GetProcessHeap () returned 0x1130000 [0056.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0056.525] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 132 [0056.525] GetProcessHeap () returned 0x1130000 [0056.525] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3810060 [0056.525] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Documents and Settings\\*") returned 31 [0056.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0xa5, ftCreationTime.dwLowDateTime=0x3bdfae8, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x3bdfbf8, ftLastWriteTime.dwLowDateTime=0x77c08fb3, ftLastWriteTime.dwHighDateTime=0x75ea51f0, nFileSizeHigh=0x3ac, nFileSizeLow=0x77c08fcf, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="", cAlternateFileName="")) returned 0xffffffff [0056.525] wnsprintfW (in: pszDest=0x3810060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Documents and Settings\\read_me.txt") returned 41 [0056.525] GetProcessHeap () returned 0x1130000 [0056.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3810060 | out: hHeap=0x1130000) returned 1 [0056.525] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 75 [0056.525] GetProcessHeap () returned 0x1130000 [0056.525] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.525] GetProcessHeap () returned 0x1130000 [0056.525] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.525] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ESD\\*") returned 12 [0056.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xf2a1793c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.525] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ESD\\.") returned 12 [0056.525] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xf2a1793c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.525] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ESD\\..") returned 13 [0056.525] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a1793c, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2a1793c, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a1793c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.525] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ESD\\read_me.txt") returned 22 [0056.525] CreateFileW (lpFileName="\\\\?\\C:\\ESD\\read_me.txt" (normalized: "c:\\esd\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.526] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.526] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.538] CloseHandle (hObject=0x3a8) returned 1 [0056.547] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a1793c, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2a1793c, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a1793c, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0056.555] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.566] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\ESD\\read_me.txt") returned 22 [0056.566] GetProcessHeap () returned 0x1130000 [0056.577] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.577] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 76 [0056.578] GetProcessHeap () returned 0x1130000 [0056.578] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3800058 | out: hHeap=0x1130000) returned 1 [0056.619] GetProcessHeap () returned 0x1130000 [0056.619] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3830070 [0056.619] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Recovery\\*") returned 17 [0056.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf2a89fdd, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0056.620] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\.") returned 17 [0056.620] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf2a89fdd, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0056.620] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\..") returned 18 [0056.620] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="Logs", cAlternateFileName="")) returned 1 [0056.620] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\Logs") returned 20 [0056.620] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2a89fdd, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2a89fdd, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2a89fdd, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0056.620] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\read_me.txt") returned 27 [0056.620] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\read_me.txt" (normalized: "c:\\recovery\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.620] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0056.620] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0056.620] CloseHandle (hObject=0x3a8) returned 1 [0056.620] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 1 [0056.620] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\ReAgentOld.xml") returned 30 [0056.620] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0056.621] StrStrW (lpFirst="ReAgentOld.xml", lpSrch=".wctc") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="read_me.txt") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="autoexec.bat") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="desktop.ini") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="autorun.inf") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="ntuser.dat") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="iconcache.db") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="bootsect.bak") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="boot.ini") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="ntuser.dat.log") returned 0x0 [0056.621] StrStrW (lpFirst="reagentold.xml", lpSrch="thumbs.db") returned 0x0 [0056.621] GetProcessHeap () returned 0x1130000 [0056.621] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.621] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Recovery\\ReAgentOld.xml.wctc") returned 35 [0056.621] CloseHandle (hObject=0x3a8) returned 1 [0056.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), lpNewFileName="\\\\?\\C:\\Recovery\\ReAgentOld.xml.wctc" (normalized: "c:\\recovery\\reagentold.xml.wctc")) returned 1 [0056.622] GetProcessHeap () returned 0x1130000 [0056.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.622] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 193 [0056.622] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0056.622] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="reagentold.xml", cAlternateFileName="REAGEN~1.XML")) returned 0 [0056.622] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0056.622] wnsprintfW (in: pszDest=0x3830070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Recovery\\read_me.txt") returned 27 [0056.622] GetProcessHeap () returned 0x1130000 [0056.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3830070 | out: hHeap=0x1130000) returned 1 [0056.622] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 78 [0056.622] GetProcessHeap () returned 0x1130000 [0056.622] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3850080 | out: hHeap=0x1130000) returned 1 [0056.784] GetProcessHeap () returned 0x1130000 [0056.784] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0056.833] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu\\*") returned 33 [0056.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="reagentold.xml", cAlternateFileName="")) returned 0xffffffff [0056.833] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu\\read_me.txt") returned 43 [0056.833] GetProcessHeap () returned 0x1130000 [0056.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0056.833] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 103 [0056.833] GetProcessHeap () returned 0x1130000 [0056.833] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3cc00b8 | out: hHeap=0x1130000) returned 1 [0056.980] GetProcessHeap () returned 0x1130000 [0056.994] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0056.994] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music\\*") returned 40 [0056.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="reagentold.xml", cAlternateFileName="")) returned 0xffffffff [0056.994] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\My Music\\read_me.txt") returned 50 [0056.994] GetProcessHeap () returned 0x1130000 [0056.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0056.995] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 114 [0056.995] GetProcessHeap () returned 0x1130000 [0056.995] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3d90120 | out: hHeap=0x1130000) returned 1 [0057.067] GetProcessHeap () returned 0x1130000 [0057.067] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x4000058 [0057.067] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\*") returned 49 [0057.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92b83d60, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x976f4c0, ftLastAccessTime.dwHighDateTime=0x1d4c5cf, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.067] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\.") returned 49 [0057.067] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92b83d60, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x976f4c0, ftLastAccessTime.dwHighDateTime=0x1d4c5cf, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.067] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\..") returned 50 [0057.067] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4271360, ftCreationTime.dwHighDateTime=0x1d4ca1d, ftLastAccessTime.dwLowDateTime=0x677b7b0, ftLastAccessTime.dwHighDateTime=0x1d4c641, ftLastWriteTime.dwLowDateTime=0x677b7b0, ftLastWriteTime.dwHighDateTime=0x1d4c641, nFileSizeHigh=0x0, nFileSizeLow=0xe514, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="5ZGBBIb9BsQj.csv", cAlternateFileName="5ZGBBI~1.CSV")) returned 1 [0057.067] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\5ZGBBIb9BsQj.csv") returned 64 [0057.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\5ZGBBIb9BsQj.csv" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\hidedkwhfj4z\\5zgbbib9bsqj.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0057.067] StrStrW (lpFirst="5ZGBBIb9BsQj.csv", lpSrch=".wctc") returned 0x0 [0057.067] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="read_me.txt") returned 0x0 [0057.067] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="autoexec.bat") returned 0x0 [0057.068] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="desktop.ini") returned 0x0 [0057.068] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="autorun.inf") returned 0x0 [0057.068] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="ntuser.dat") returned 0x0 [0057.068] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="iconcache.db") returned 0x0 [0057.068] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="bootsect.bak") returned 0x0 [0057.068] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="boot.ini") returned 0x0 [0057.068] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="ntuser.dat.log") returned 0x0 [0057.068] StrStrW (lpFirst="5zgbbib9bsqj.csv", lpSrch="thumbs.db") returned 0x0 [0057.068] GetProcessHeap () returned 0x1130000 [0057.068] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.069] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\5ZGBBIb9BsQj.csv.wctc") returned 69 [0057.069] CloseHandle (hObject=0x3a8) returned 1 [0057.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\5ZGBBIb9BsQj.csv" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\hidedkwhfj4z\\5zgbbib9bsqj.csv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\5ZGBBIb9BsQj.csv.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\hidedkwhfj4z\\5zgbbib9bsqj.csv.wctc")) returned 1 [0057.069] GetProcessHeap () returned 0x1130000 [0057.070] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.070] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 304 [0057.070] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0057.070] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d00120, ftCreationTime.dwHighDateTime=0x1d4c818, ftLastAccessTime.dwLowDateTime=0xb9570590, ftLastAccessTime.dwHighDateTime=0x1d4c97d, ftLastWriteTime.dwLowDateTime=0xb9570590, ftLastWriteTime.dwHighDateTime=0x1d4c97d, nFileSizeHigh=0x0, nFileSizeLow=0x2e09, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="IVHFO3q13cS.xls", cAlternateFileName="IVHFO3~1.XLS")) returned 1 [0057.070] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\IVHFO3q13cS.xls") returned 63 [0057.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\IVHFO3q13cS.xls" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\hidedkwhfj4z\\ivhfo3q13cs.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0057.070] StrStrW (lpFirst="IVHFO3q13cS.xls", lpSrch=".wctc") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="read_me.txt") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="autoexec.bat") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="desktop.ini") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="autorun.inf") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="ntuser.dat") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="iconcache.db") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="bootsect.bak") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="boot.ini") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="ntuser.dat.log") returned 0x0 [0057.070] StrStrW (lpFirst="ivhfo3q13cs.xls", lpSrch="thumbs.db") returned 0x0 [0057.070] GetProcessHeap () returned 0x1130000 [0057.070] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.070] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\IVHFO3q13cS.xls.wctc") returned 68 [0057.071] CloseHandle (hObject=0x3a8) returned 1 [0057.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\IVHFO3q13cS.xls" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\hidedkwhfj4z\\ivhfo3q13cs.xls"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\IVHFO3q13cS.xls.wctc" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\hidedkwhfj4z\\ivhfo3q13cs.xls.wctc")) returned 1 [0057.071] GetProcessHeap () returned 0x1130000 [0057.071] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.071] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 305 [0057.071] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0057.071] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e69f6f, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e69f6f, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.071] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\read_me.txt") returned 59 [0057.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\documents\\v2ue\\hidedkwhfj4z\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0057.071] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.071] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0057.071] CloseHandle (hObject=0x3a8) returned 1 [0057.072] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e69f6f, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2e69f6f, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2e69f6f, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0057.072] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.072] wnsprintfW (in: pszDest=0x4000058, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Documents\\v2ue\\hIDeDKWHFj4z\\read_me.txt") returned 59 [0057.072] GetProcessHeap () returned 0x1130000 [0057.072] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4000058 | out: hHeap=0x1130000) returned 1 [0057.072] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 123 [0057.072] GetProcessHeap () returned 0x1130000 [0057.072] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3e30170 | out: hHeap=0x1130000) returned 1 [0057.287] GetProcessHeap () returned 0x1130000 [0057.287] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f201e8 [0057.289] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\*") returned 98 [0057.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60f13370, ftCreationTime.dwHighDateTime=0x1d4cd43, ftLastAccessTime.dwLowDateTime=0xf2fdc72e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fdc72e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170ae0 [0057.290] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\.") returned 98 [0057.290] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60f13370, ftCreationTime.dwHighDateTime=0x1d4cd43, ftLastAccessTime.dwLowDateTime=0xf2fdc72e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf2fdc72e, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.290] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\..") returned 99 [0057.290] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5cb966d0, ftCreationTime.dwHighDateTime=0x1d4c698, ftLastAccessTime.dwLowDateTime=0x4da98380, ftLastAccessTime.dwHighDateTime=0x1d4c82f, ftLastWriteTime.dwLowDateTime=0x4da98380, ftLastWriteTime.dwHighDateTime=0x1d4c82f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="aKjOckxU5PAtg9", cAlternateFileName="AKJOCK~1")) returned 1 [0057.290] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\aKjOckxU5PAtg9") returned 111 [0057.290] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23676570, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0x4e339980, ftLastAccessTime.dwHighDateTime=0x1d4c7cb, ftLastWriteTime.dwLowDateTime=0x4e339980, ftLastWriteTime.dwHighDateTime=0x1d4c7cb, nFileSizeHigh=0x0, nFileSizeLow=0x18b58, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="iARgNpFhhdr3YSYS3xND.wav", cAlternateFileName="IARGNP~1.WAV")) returned 1 [0057.290] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\iARgNpFhhdr3YSYS3xND.wav") returned 121 [0057.290] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\iARgNpFhhdr3YSYS3xND.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\iargnpfhhdr3ysys3xnd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.290] StrStrW (lpFirst="iARgNpFhhdr3YSYS3xND.wav", lpSrch=".wctc") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="read_me.txt") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="autoexec.bat") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="desktop.ini") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="autorun.inf") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="ntuser.dat") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="iconcache.db") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="bootsect.bak") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="boot.ini") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="ntuser.dat.log") returned 0x0 [0057.290] StrStrW (lpFirst="iargnpfhhdr3ysys3xnd.wav", lpSrch="thumbs.db") returned 0x0 [0057.290] GetProcessHeap () returned 0x1130000 [0057.291] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0057.291] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\iARgNpFhhdr3YSYS3xND.wav.wctc") returned 126 [0057.292] CloseHandle (hObject=0x3c0) returned 1 [0057.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\iARgNpFhhdr3YSYS3xND.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\iargnpfhhdr3ysys3xnd.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\iARgNpFhhdr3YSYS3xND.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\iargnpfhhdr3ysys3xnd.wav.wctc")) returned 1 [0057.292] GetProcessHeap () returned 0x1130000 [0057.292] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.292] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 342 [0057.292] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.292] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26495f00, ftCreationTime.dwHighDateTime=0x1d4d364, ftLastAccessTime.dwLowDateTime=0xb5d0c480, ftLastAccessTime.dwHighDateTime=0x1d4c84a, ftLastWriteTime.dwLowDateTime=0xb5d0c480, ftLastWriteTime.dwHighDateTime=0x1d4c84a, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="pqQrNVtKig.wav", cAlternateFileName="PQQRNV~1.WAV")) returned 1 [0057.292] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\pqQrNVtKig.wav") returned 111 [0057.292] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\pqQrNVtKig.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\pqqrnvtkig.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.292] StrStrW (lpFirst="pqQrNVtKig.wav", lpSrch=".wctc") returned 0x0 [0057.292] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="read_me.txt") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="autoexec.bat") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="desktop.ini") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="autorun.inf") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="ntuser.dat") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="iconcache.db") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="bootsect.bak") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="boot.ini") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="ntuser.dat.log") returned 0x0 [0057.293] StrStrW (lpFirst="pqqrnvtkig.wav", lpSrch="thumbs.db") returned 0x0 [0057.293] GetProcessHeap () returned 0x1130000 [0057.293] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0057.293] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\pqQrNVtKig.wav.wctc") returned 116 [0057.293] CloseHandle (hObject=0x3c0) returned 1 [0057.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\pqQrNVtKig.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\pqqrnvtkig.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\pqQrNVtKig.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\pqqrnvtkig.wav.wctc")) returned 1 [0057.294] GetProcessHeap () returned 0x1130000 [0057.294] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.294] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 343 [0057.294] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.294] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69119bb0, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0xd4d97820, ftLastAccessTime.dwHighDateTime=0x1d4cb49, ftLastWriteTime.dwLowDateTime=0xd4d97820, ftLastWriteTime.dwHighDateTime=0x1d4cb49, nFileSizeHigh=0x0, nFileSizeLow=0xd44, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="QRrtTlFg60jlHevE_.mp3", cAlternateFileName="QRRTTL~1.MP3")) returned 1 [0057.294] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\QRrtTlFg60jlHevE_.mp3") returned 118 [0057.294] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\QRrtTlFg60jlHevE_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\qrrttlfg60jlheve_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.294] StrStrW (lpFirst="QRrtTlFg60jlHevE_.mp3", lpSrch=".wctc") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="read_me.txt") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="autoexec.bat") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="desktop.ini") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="autorun.inf") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="ntuser.dat") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="iconcache.db") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="bootsect.bak") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="boot.ini") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="ntuser.dat.log") returned 0x0 [0057.294] StrStrW (lpFirst="qrrttlfg60jlheve_.mp3", lpSrch="thumbs.db") returned 0x0 [0057.294] GetProcessHeap () returned 0x1130000 [0057.294] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0057.295] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\QRrtTlFg60jlHevE_.mp3.wctc") returned 123 [0057.295] CloseHandle (hObject=0x3c0) returned 1 [0057.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\QRrtTlFg60jlHevE_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\qrrttlfg60jlheve_.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\QRrtTlFg60jlHevE_.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\qrrttlfg60jlheve_.mp3.wctc")) returned 1 [0057.295] GetProcessHeap () returned 0x1130000 [0057.295] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.295] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 344 [0057.295] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.295] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fdc72e, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf2fdc72e, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30028d3, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.295] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\read_me.txt") returned 108 [0057.295] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.295] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.295] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0057.295] CloseHandle (hObject=0x3c0) returned 1 [0057.296] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe36c0f90, ftCreationTime.dwHighDateTime=0x1d4c97a, ftLastAccessTime.dwLowDateTime=0xc831f330, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0xc831f330, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x4060, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="vuQEoS_cYD4DBfb.mp3", cAlternateFileName="VUQEOS~1.MP3")) returned 1 [0057.296] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\vuQEoS_cYD4DBfb.mp3") returned 116 [0057.296] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\vuQEoS_cYD4DBfb.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\vuqeos_cyd4dbfb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.296] StrStrW (lpFirst="vuQEoS_cYD4DBfb.mp3", lpSrch=".wctc") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="read_me.txt") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="autoexec.bat") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="desktop.ini") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="autorun.inf") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="ntuser.dat") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="iconcache.db") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="bootsect.bak") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="boot.ini") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="ntuser.dat.log") returned 0x0 [0057.296] StrStrW (lpFirst="vuqeos_cyd4dbfb.mp3", lpSrch="thumbs.db") returned 0x0 [0057.296] GetProcessHeap () returned 0x1130000 [0057.296] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0057.296] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\vuQEoS_cYD4DBfb.mp3.wctc") returned 121 [0057.296] CloseHandle (hObject=0x3c0) returned 1 [0057.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\vuQEoS_cYD4DBfb.mp3" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\vuqeos_cyd4dbfb.mp3"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\vuQEoS_cYD4DBfb.mp3.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\vuqeos_cyd4dbfb.mp3.wctc")) returned 1 [0057.297] GetProcessHeap () returned 0x1130000 [0057.297] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.297] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 345 [0057.297] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.297] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0048b0, ftCreationTime.dwHighDateTime=0x1d4ce62, ftLastAccessTime.dwLowDateTime=0xaa8aef90, ftLastAccessTime.dwHighDateTime=0x1d4caf4, ftLastWriteTime.dwLowDateTime=0xaa8aef90, ftLastWriteTime.dwHighDateTime=0x1d4caf4, nFileSizeHigh=0x0, nFileSizeLow=0x13d7f, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="Z9USnIN6pPHmMNoCY.wav", cAlternateFileName="Z9USNI~1.WAV")) returned 1 [0057.297] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\Z9USnIN6pPHmMNoCY.wav") returned 118 [0057.297] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\Z9USnIN6pPHmMNoCY.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\z9usnin6pphmmnocy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0057.297] StrStrW (lpFirst="Z9USnIN6pPHmMNoCY.wav", lpSrch=".wctc") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="read_me.txt") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="autoexec.bat") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="desktop.ini") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="autorun.inf") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="ntuser.dat") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="iconcache.db") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="bootsect.bak") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="boot.ini") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="ntuser.dat.log") returned 0x0 [0057.297] StrStrW (lpFirst="z9usnin6pphmmnocy.wav", lpSrch="thumbs.db") returned 0x0 [0057.297] GetProcessHeap () returned 0x1130000 [0057.298] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3f001d8 [0057.298] wnsprintfW (in: pszDest=0x3f001d8, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\Z9USnIN6pPHmMNoCY.wav.wctc") returned 123 [0057.298] CloseHandle (hObject=0x3c0) returned 1 [0057.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\Z9USnIN6pPHmMNoCY.wav" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\z9usnin6pphmmnocy.wav"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\Z9USnIN6pPHmMNoCY.wav.wctc" (normalized: "c:\\users\\fd1hvy\\music\\4ftij2yrkuql_wf f1b\\e4orhiul1abhqg8kzabc\\tpulljctesey_-\\e8z5tjoplk1iy6\\z9usnin6pphmmnocy.wav.wctc")) returned 1 [0057.298] GetProcessHeap () returned 0x1130000 [0057.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f001d8 | out: hHeap=0x1130000) returned 1 [0057.298] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 346 [0057.298] QueueUserWorkItem (Function=0x1294e00, Context=0x3c0, Flags=0x0) returned 1 [0057.298] FindNextFileW (in: hFindFile=0x1170ae0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0048b0, ftCreationTime.dwHighDateTime=0x1d4ce62, ftLastAccessTime.dwLowDateTime=0xaa8aef90, ftLastAccessTime.dwHighDateTime=0x1d4caf4, ftLastWriteTime.dwLowDateTime=0xaa8aef90, ftLastWriteTime.dwHighDateTime=0x1d4caf4, nFileSizeHigh=0x0, nFileSizeLow=0x13d7f, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="z9usnin6pphmmnocy.wav", cAlternateFileName="Z9USNI~1.WAV")) returned 0 [0057.298] FindClose (in: hFindFile=0x1170ae0 | out: hFindFile=0x1170ae0) returned 1 [0057.298] wnsprintfW (in: pszDest=0x3f201e8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Music\\4FTiJ2yRkuQl_WF f1B\\e4orhIul1aBHqg8KZabc\\TpUlLJCtEsEy_-\\E8Z5TJoPLK1iy6\\read_me.txt") returned 108 [0057.298] GetProcessHeap () returned 0x1130000 [0057.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f201e8 | out: hHeap=0x1130000) returned 1 [0057.298] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 139 [0057.298] GetProcessHeap () returned 0x1130000 [0057.298] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3f401f8 | out: hHeap=0x1130000) returned 1 [0057.379] GetProcessHeap () returned 0x1130000 [0057.379] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.380] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*") returned 42 [0057.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170fa0 [0057.380] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\.") returned 42 [0057.380] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.380] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\..") returned 43 [0057.380] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.380] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned 52 [0057.380] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0057.380] StrStrW (lpFirst="desktop.ini", lpSrch=".wctc") returned 0x0 [0057.380] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0057.380] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0057.380] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0057.380] CloseHandle (hObject=0x3b0) returned 1 [0057.380] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30c1ee4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30c1ee4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.380] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\read_me.txt") returned 52 [0057.380] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b0 [0057.380] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.380] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0057.381] CloseHandle (hObject=0x3b0) returned 1 [0057.381] FindNextFileW (in: hFindFile=0x1170fa0, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30c1ee4, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf30c1ee4, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf30c1ee4, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0057.381] FindClose (in: hFindFile=0x1170fa0 | out: hFindFile=0x1170fa0) returned 1 [0057.381] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\read_me.txt") returned 52 [0057.381] GetProcessHeap () returned 0x1130000 [0057.381] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.381] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 148 [0057.381] GetProcessHeap () returned 0x1130000 [0057.381] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3650080 | out: hHeap=0x1130000) returned 1 [0057.452] GetProcessHeap () returned 0x1130000 [0057.452] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x11acf90 [0057.452] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\*") returned 72 [0057.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\*", lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e70580, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xb93b2330, ftLastAccessTime.dwHighDateTime=0x1d4d480, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName=".", cAlternateFileName="")) returned 0x1170860 [0057.452] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\.") returned 72 [0057.452] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e70580, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xb93b2330, ftLastAccessTime.dwHighDateTime=0x1d4d480, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="..", cAlternateFileName="")) returned 1 [0057.452] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\..") returned 73 [0057.452] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af19370, ftCreationTime.dwHighDateTime=0x1d4ca4d, ftLastAccessTime.dwLowDateTime=0x9f55ec80, ftLastAccessTime.dwHighDateTime=0x1d4cd3b, ftLastWriteTime.dwLowDateTime=0x9f55ec80, ftLastWriteTime.dwHighDateTime=0x1d4cd3b, nFileSizeHigh=0x0, nFileSizeLow=0x18ef, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="LElHIbEhhUx_6V5o.avi", cAlternateFileName="LELHIB~1.AVI")) returned 1 [0057.452] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\LElHIbEhhUx_6V5o.avi") returned 91 [0057.452] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\LElHIbEhhUx_6V5o.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\lelhibehhux_6v5o.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0057.453] StrStrW (lpFirst="LElHIbEhhUx_6V5o.avi", lpSrch=".wctc") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="read_me.txt") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="autoexec.bat") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="desktop.ini") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="autorun.inf") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="ntuser.dat") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="iconcache.db") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="bootsect.bak") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="boot.ini") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="ntuser.dat.log") returned 0x0 [0057.453] StrStrW (lpFirst="lelhibehhux_6v5o.avi", lpSrch="thumbs.db") returned 0x0 [0057.453] GetProcessHeap () returned 0x1130000 [0057.453] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.454] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\LElHIbEhhUx_6V5o.avi.wctc") returned 96 [0057.454] CloseHandle (hObject=0x3a8) returned 1 [0057.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\LElHIbEhhUx_6V5o.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\lelhibehhux_6v5o.avi"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\LElHIbEhhUx_6V5o.avi.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\lelhibehhux_6v5o.avi.wctc")) returned 1 [0057.454] GetProcessHeap () returned 0x1130000 [0057.454] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.454] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 421 [0057.454] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0057.455] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf328b3f5, ftCreationTime.dwHighDateTime=0x1d59eb1, ftLastAccessTime.dwLowDateTime=0xf328b3f5, ftLastAccessTime.dwHighDateTime=0x1d59eb1, ftLastWriteTime.dwLowDateTime=0xf328b3f5, ftLastWriteTime.dwHighDateTime=0x1d59eb1, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0057.455] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\read_me.txt") returned 82 [0057.455] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\read_me.txt" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0057.455] StrStrW (lpFirst="read_me.txt", lpSrch=".wctc") returned 0x0 [0057.455] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0057.455] CloseHandle (hObject=0x3a8) returned 1 [0057.455] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ff2200, ftCreationTime.dwHighDateTime=0x1d4d4de, ftLastAccessTime.dwLowDateTime=0x4030740, ftLastAccessTime.dwHighDateTime=0x1d4c83b, ftLastWriteTime.dwLowDateTime=0x4030740, ftLastWriteTime.dwHighDateTime=0x1d4c83b, nFileSizeHigh=0x0, nFileSizeLow=0x23a6, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="RWEgGz15RrvB7935.avi", cAlternateFileName="RWEGGZ~1.AVI")) returned 1 [0057.455] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\RWEgGz15RrvB7935.avi") returned 91 [0057.455] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\RWEgGz15RrvB7935.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\rweggz15rrvb7935.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0057.455] StrStrW (lpFirst="RWEgGz15RrvB7935.avi", lpSrch=".wctc") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="read_me.txt") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="autoexec.bat") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="desktop.ini") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="autorun.inf") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="ntuser.dat") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="iconcache.db") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="bootsect.bak") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="boot.ini") returned 0x0 [0057.455] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="ntuser.dat.log") returned 0x0 [0057.456] StrStrW (lpFirst="rweggz15rrvb7935.avi", lpSrch="thumbs.db") returned 0x0 [0057.456] GetProcessHeap () returned 0x1130000 [0057.456] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.456] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\RWEgGz15RrvB7935.avi.wctc") returned 96 [0057.456] CloseHandle (hObject=0x3a8) returned 1 [0057.456] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\RWEgGz15RrvB7935.avi" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\rweggz15rrvb7935.avi"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\RWEgGz15RrvB7935.avi.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\rweggz15rrvb7935.avi.wctc")) returned 1 [0057.456] GetProcessHeap () returned 0x1130000 [0057.456] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.456] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 422 [0057.456] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0057.456] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbc34d0, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x1e1119f0, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0x1e1119f0, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x1559a, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="wp-7Bz CC.mkv", cAlternateFileName="WP-7BZ~1.MKV")) returned 1 [0057.456] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\wp-7Bz CC.mkv") returned 84 [0057.456] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\wp-7Bz CC.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\wp-7bz cc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0057.456] StrStrW (lpFirst="wp-7Bz CC.mkv", lpSrch=".wctc") returned 0x0 [0057.456] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="read_me.txt") returned 0x0 [0057.456] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="autoexec.bat") returned 0x0 [0057.456] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="desktop.ini") returned 0x0 [0057.457] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="autorun.inf") returned 0x0 [0057.457] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="ntuser.dat") returned 0x0 [0057.457] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="iconcache.db") returned 0x0 [0057.457] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="bootsect.bak") returned 0x0 [0057.457] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="boot.ini") returned 0x0 [0057.457] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="ntuser.dat.log") returned 0x0 [0057.457] StrStrW (lpFirst="wp-7bz cc.mkv", lpSrch="thumbs.db") returned 0x0 [0057.457] GetProcessHeap () returned 0x1130000 [0057.457] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0xfffe) returned 0x3680098 [0057.457] wnsprintfW (in: pszDest=0x3680098, cchDest=32767, pszFmt="%s.wctc" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\wp-7Bz CC.mkv.wctc") returned 89 [0057.457] CloseHandle (hObject=0x3a8) returned 1 [0057.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\wp-7Bz CC.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\wp-7bz cc.mkv"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\wp-7Bz CC.mkv.wctc" (normalized: "c:\\users\\fd1hvy\\videos\\x89rl\\jpvh\\pz4ukyicvjetk9jr\\xhstzp32bgqia7f\\wp-7bz cc.mkv.wctc")) returned 1 [0057.457] GetProcessHeap () returned 0x1130000 [0057.457] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3680098 | out: hHeap=0x1130000) returned 1 [0057.457] InterlockedExchangeAdd (in: Addend=0x129f064, Value=1 | out: Addend=0x129f064) returned 423 [0057.457] QueueUserWorkItem (Function=0x1294e00, Context=0x3a8, Flags=0x0) returned 1 [0057.457] FindNextFileW (in: hFindFile=0x1170860, lpFindFileData=0x3bdfa98 | out: lpFindFileData=0x3bdfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbc34d0, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x1e1119f0, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0x1e1119f0, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x1559a, dwReserved0=0x0, dwReserved1=0xb40608, cFileName="wp-7bz cc.mkv", cAlternateFileName="WP-7BZ~1.MKV")) returned 0 [0057.458] FindClose (in: hFindFile=0x1170860 | out: hFindFile=0x1170860) returned 1 [0057.458] wnsprintfW (in: pszDest=0x11acf90, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\FD1HVy\\Videos\\x89rl\\jpvh\\PZ4ukYICvjeTK9jR\\xHSTZp32BgqiA7f\\read_me.txt") returned 82 [0057.458] GetProcessHeap () returned 0x1130000 [0057.458] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11acf90 | out: hHeap=0x1130000) returned 1 [0057.459] InterlockedExchangeAdd (in: Addend=0x129f16c, Value=1 | out: Addend=0x129f16c) returned 161 [0057.459] GetProcessHeap () returned 0x1130000 [0057.459] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x4070090 | out: hHeap=0x1130000) returned 1 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175928 [0057.688] SystemFunction036 (in: RandomBuffer=0x1175928, RandomBufferLength=0x20 | out: RandomBuffer=0x1175928) returned 1 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36910d0 [0057.688] ReadFile (in: hFile=0x3b0, lpBuffer=0x36910d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36910d0, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150af8 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175b30 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ae8, Size=0x20) returned 0x1175950 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.688] GetProcessHeap () returned 0x1130000 [0057.688] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.689] GetProcessHeap () returned 0x1130000 [0057.689] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177928 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177928 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.690] GetProcessHeap () returned 0x1130000 [0057.690] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0048 [0057.691] GetProcessHeap () returned 0x1130000 [0057.691] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x121ece0 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0048 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0048 | out: hHeap=0x1130000) returned 1 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0057.692] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.692] WriteFile (in: hFile=0x3b0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0057.692] CloseHandle (hObject=0x3b0) returned 0 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36910d0 | out: hHeap=0x1130000) returned 1 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0057.692] GetProcessHeap () returned 0x1130000 [0057.692] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0057.692] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 133 [0057.819] GetProcessHeap () returned 0x1130000 [0057.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0057.819] GetProcessHeap () returned 0x1130000 [0057.819] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175860 [0057.824] SystemFunction036 (in: RandomBuffer=0x1175860, RandomBufferLength=0x20 | out: RandomBuffer=0x1175860) returned 1 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x36920d8 [0057.824] ReadFile (in: hFile=0x3c0, lpBuffer=0x36920d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x36920d8, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c78, Size=0x20) returned 0x1175720 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150be8, Size=0x20) returned 0x1175b58 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.824] GetProcessHeap () returned 0x1130000 [0057.824] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bb8 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bb8 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0057.825] GetProcessHeap () returned 0x1130000 [0057.825] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.825] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115df38 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115df38 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0270 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0478 [0057.826] GetProcessHeap () returned 0x1130000 [0057.826] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0270 | out: hHeap=0x1130000) returned 1 [0057.826] GetProcessHeap () returned 0x1130000 [0057.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0270 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0478 | out: hHeap=0x1130000) returned 1 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0478 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0270 | out: hHeap=0x1130000) returned 1 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0270 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0478 | out: hHeap=0x1130000) returned 1 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0478 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0270 | out: hHeap=0x1130000) returned 1 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0270 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0478 | out: hHeap=0x1130000) returned 1 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0478 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0270 | out: hHeap=0x1130000) returned 1 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0270 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0478 | out: hHeap=0x1130000) returned 1 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0478 [0057.827] GetProcessHeap () returned 0x1130000 [0057.827] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0270 | out: hHeap=0x1130000) returned 1 [0057.827] GetProcessHeap () returned 0x1130000 [0057.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0270 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0478 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0478 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0270 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x3fe0270 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0478 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x3fe0478 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0270 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3fe0478 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175720 | out: hHeap=0x1130000) returned 1 [0057.828] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.828] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0057.828] CloseHandle (hObject=0x3c0) returned 0 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36920d8 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175860 | out: hHeap=0x1130000) returned 1 [0057.828] GetProcessHeap () returned 0x1130000 [0057.828] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0057.828] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 151 [0057.929] GetProcessHeap () returned 0x1130000 [0057.930] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0057.931] GetProcessHeap () returned 0x1130000 [0057.931] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175748 [0057.931] SystemFunction036 (in: RandomBuffer=0x1175748, RandomBufferLength=0x20 | out: RandomBuffer=0x1175748) returned 1 [0057.932] GetProcessHeap () returned 0x1130000 [0057.946] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0057.949] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0057.949] GetProcessHeap () returned 0x1130000 [0057.949] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0057.949] GetProcessHeap () returned 0x1130000 [0057.949] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bb8 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bb8, Size=0x20) returned 0x11758d8 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175ba8 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.961] GetProcessHeap () returned 0x1130000 [0057.961] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177988 [0057.962] GetProcessHeap () returned 0x1130000 [0057.962] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e298 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177988 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e298 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.963] GetProcessHeap () returned 0x1130000 [0057.963] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0057.964] GetProcessHeap () returned 0x1130000 [0057.964] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0057.965] GetProcessHeap () returned 0x1130000 [0057.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0057.965] GetProcessHeap () returned 0x1130000 [0057.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175ba8 | out: hHeap=0x1130000) returned 1 [0057.965] GetProcessHeap () returned 0x1130000 [0057.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0057.965] GetProcessHeap () returned 0x1130000 [0057.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11758d8 | out: hHeap=0x1130000) returned 1 [0057.965] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0057.965] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0057.965] CloseHandle (hObject=0x3c0) returned 0 [0057.965] GetProcessHeap () returned 0x1130000 [0057.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0057.965] GetProcessHeap () returned 0x1130000 [0057.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175748 | out: hHeap=0x1130000) returned 1 [0057.965] GetProcessHeap () returned 0x1130000 [0057.965] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0057.965] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 170 [0058.169] GetProcessHeap () returned 0x1130000 [0058.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.169] GetProcessHeap () returned 0x1130000 [0058.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175a40 [0058.169] SystemFunction036 (in: RandomBuffer=0x1175a40, RandomBufferLength=0x20 | out: RandomBuffer=0x1175a40) returned 1 [0058.169] GetProcessHeap () returned 0x1130000 [0058.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.169] ReadFile (in: hFile=0x3a8, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0058.169] GetProcessHeap () returned 0x1130000 [0058.169] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150c68, Size=0x20) returned 0x1175a68 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b88 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b88, Size=0x20) returned 0x1175900 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ae8 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.170] GetProcessHeap () returned 0x1130000 [0058.170] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779b8 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115ddd0 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779b8 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115ddd0 | out: hHeap=0x1130000) returned 1 [0058.171] GetProcessHeap () returned 0x1130000 [0058.171] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153380 [0058.171] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153380 | out: hHeap=0x1130000) returned 1 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.172] GetProcessHeap () returned 0x1130000 [0058.172] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175900 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.173] GetProcessHeap () returned 0x1130000 [0058.173] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.173] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.173] WriteFile (in: hFile=0x3a8, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0058.173] CloseHandle (hObject=0x3a8) returned 0 [0058.174] GetProcessHeap () returned 0x1130000 [0058.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.174] GetProcessHeap () returned 0x1130000 [0058.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.174] GetProcessHeap () returned 0x1130000 [0058.174] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.174] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 192 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153278 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175950 [0058.310] SystemFunction036 (in: RandomBuffer=0x1175950, RandomBufferLength=0x20 | out: RandomBuffer=0x1175950) returned 1 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.310] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bd8 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150bd8, Size=0x20) returned 0x1175928 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150c78, Size=0x20) returned 0x11756f8 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.310] GetProcessHeap () returned 0x1130000 [0058.310] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b68 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b68 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.311] GetProcessHeap () returned 0x1130000 [0058.311] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.311] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x11779b8 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e1c0 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11779b8 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1151ee0 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e1c0 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11537a0 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1151ee0 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11537a0 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.312] GetProcessHeap () returned 0x1130000 [0058.312] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.313] GetProcessHeap () returned 0x1130000 [0058.313] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175928 | out: hHeap=0x1130000) returned 1 [0058.314] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.314] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153278, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0058.314] CloseHandle (hObject=0x3c0) returned 0 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175950 | out: hHeap=0x1130000) returned 1 [0058.314] GetProcessHeap () returned 0x1130000 [0058.314] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153278 | out: hHeap=0x1130000) returned 1 [0058.314] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 210 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153488 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175b30 [0058.482] SystemFunction036 (in: RandomBuffer=0x1175b30, RandomBufferLength=0x20 | out: RandomBuffer=0x1175b30) returned 1 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.482] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c68 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b58 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b58, Size=0x20) returned 0x1175a68 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150ba8 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150ba8, Size=0x20) returned 0x1175770 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bc8 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0058.482] GetProcessHeap () returned 0x1130000 [0058.482] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.482] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b78 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ba8 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b78 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ba8 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.483] GetProcessHeap () returned 0x1130000 [0058.483] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.483] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c78 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177898 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177898 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152760 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152760 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.484] GetProcessHeap () returned 0x1130000 [0058.484] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.485] GetProcessHeap () returned 0x1130000 [0058.485] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175770 | out: hHeap=0x1130000) returned 1 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a68 | out: hHeap=0x1130000) returned 1 [0058.486] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.486] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153488, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0058.486] CloseHandle (hObject=0x3c0) returned 0 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b30 | out: hHeap=0x1130000) returned 1 [0058.486] GetProcessHeap () returned 0x1130000 [0058.486] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153488 | out: hHeap=0x1130000) returned 1 [0058.486] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 258 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x11756f8 [0058.607] SystemFunction036 (in: RandomBuffer=0x11756f8, RandomBufferLength=0x20 | out: RandomBuffer=0x11756f8) returned 1 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.607] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150c78 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b78 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b78, Size=0x20) returned 0x1175a40 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b48, Size=0x20) returned 0x1175b58 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150af8 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bd8 [0058.607] GetProcessHeap () returned 0x1130000 [0058.607] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150af8 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150be8 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bd8 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c98 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.608] GetProcessHeap () returned 0x1130000 [0058.608] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c98 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177b98 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115e4d8 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177b98 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x1152b18 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115e4d8 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1152b18 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5b30 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5b30 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.609] GetProcessHeap () returned 0x1130000 [0058.609] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5518 [0058.610] GetProcessHeap () returned 0x1130000 [0058.610] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.610] GetProcessHeap () returned 0x1130000 [0058.611] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.611] GetProcessHeap () returned 0x1130000 [0058.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5518 | out: hHeap=0x1130000) returned 1 [0058.611] GetProcessHeap () returned 0x1130000 [0058.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c78 | out: hHeap=0x1130000) returned 1 [0058.611] GetProcessHeap () returned 0x1130000 [0058.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175b58 | out: hHeap=0x1130000) returned 1 [0058.611] GetProcessHeap () returned 0x1130000 [0058.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.611] GetProcessHeap () returned 0x1130000 [0058.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175a40 | out: hHeap=0x1130000) returned 1 [0058.611] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.611] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0058.611] CloseHandle (hObject=0x3c0) returned 0 [0058.611] GetProcessHeap () returned 0x1130000 [0058.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.611] GetProcessHeap () returned 0x1130000 [0058.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756f8 | out: hHeap=0x1130000) returned 1 [0058.611] GetProcessHeap () returned 0x1130000 [0058.611] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.611] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 319 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x1153170 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x20) returned 0x1175798 [0058.796] SystemFunction036 (in: RandomBuffer=0x1175798, RandomBufferLength=0x20 | out: RandomBuffer=0x1175798) returned 1 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x1000) returned 0x3699110 [0058.796] ReadFile (in: hFile=0x3c0, lpBuffer=0x3699110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bdfc5c, lpOverlapped=0x0 | out: lpBuffer=0x3699110, lpNumberOfBytesRead=0x3bdfc5c*=0x0, lpOverlapped=0x0) returned 0 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150be8 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b48 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlReAllocateHeap (Heap=0x1130000, Flags=0x8, Ptr=0x1150b48, Size=0x20) returned 0x11756d0 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150b68 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlReAllocateHeap (Heap=0x1130000, Flags=0x0, Ptr=0x1150b68, Size=0x20) returned 0x1175888 [0058.796] GetProcessHeap () returned 0x1130000 [0058.796] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x8, Size=0x4) returned 0x1150bf8 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150ae8 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150ae8 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b88 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b88 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b58 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.797] GetProcessHeap () returned 0x1130000 [0058.797] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b58 | out: hHeap=0x1130000) returned 1 [0058.797] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bc8 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c68 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bc8 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150b48 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c68 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150bf8 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150b48 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x8) returned 0x1150c88 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150bf8 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x24) returned 0x1177958 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150c88 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x40) returned 0x115dfc8 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1177958 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x80) returned 0x11525c8 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x115dfc8 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x100) returned 0x11539b0 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11525c8 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11539b0 | out: hHeap=0x1130000) returned 1 [0058.798] GetProcessHeap () returned 0x1130000 [0058.798] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5720 [0058.799] GetProcessHeap () returned 0x1130000 [0058.799] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5d38 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5720 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5108 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5d38 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5310 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5108 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x200) returned 0x36c5928 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5310 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] RtlAllocateHeap (HeapHandle=0x1130000, Flags=0x0, Size=0x220) returned 0x121ece0 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x36c5928 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1150be8 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175888 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x121ece0 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x11756d0 | out: hHeap=0x1130000) returned 1 [0058.800] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 0 [0058.800] WriteFile (in: hFile=0x3c0, lpBuffer=0x1153170, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x3bdfc78, lpOverlapped=0x0) returned 0 [0058.800] CloseHandle (hObject=0x3c0) returned 0 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x3699110 | out: hHeap=0x1130000) returned 1 [0058.800] GetProcessHeap () returned 0x1130000 [0058.800] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1175798 | out: hHeap=0x1130000) returned 1 [0058.801] GetProcessHeap () returned 0x1130000 [0058.801] HeapFree (in: hHeap=0x1130000, dwFlags=0x0, lpMem=0x1153170 | out: hHeap=0x1130000) returned 1 [0058.801] InterlockedExchangeAdd (in: Addend=0x129f168, Value=1 | out: Addend=0x129f168) returned 386